Index: refpolicy-2.20180701/policy/flask/access_vectors
===================================================================
--- refpolicy-2.20180701.orig/policy/flask/access_vectors
+++ refpolicy-2.20180701/policy/flask/access_vectors
@@ -765,7 +765,7 @@ class key
 
 class context
 {
-	translate
+	unused_perm
 	contains
 }
 
@@ -1090,3 +1090,6 @@ class bpf
 	prog_load
 	prog_run
 }
+
+class xdp_socket
+inherits socket
Index: refpolicy-2.20180701/policy/flask/security_classes
===================================================================
--- refpolicy-2.20180701.orig/policy/flask/security_classes
+++ refpolicy-2.20180701/policy/flask/security_classes
@@ -192,4 +192,6 @@ class process2
 
 class bpf
 
+class xdp_socket
+
 # FLASK
Index: refpolicy-2.20180701/policy/mls
===================================================================
--- refpolicy-2.20180701.orig/policy/mls
+++ refpolicy-2.20180701/policy/mls
@@ -764,9 +764,6 @@ mlsconstrain association { polmatch }
 # MLS policy for the context class
 #
 
-mlsconstrain context translate
-	(( h1 dom h2 ) or ( t1 == mlstranslate ));
-
 mlsconstrain context contains
 	(( h1 dom h2 ) and ( l1 domby l2));
 
Index: refpolicy-2.20180701/policy/modules/admin/logrotate.fc
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/admin/logrotate.fc
+++ refpolicy-2.20180701/policy/modules/admin/logrotate.fc
@@ -1,12 +1,11 @@
 /etc/cron\.(daily|weekly)/logrotate	--	gen_context(system_u:object_r:logrotate_exec_t,s0)
 /etc/cron\.(daily|weekly)/sysklogd	--	gen_context(system_u:object_r:logrotate_exec_t,s0)
 
-/usr/bin/logrotate	--	gen_context(system_u:object_r:logrotate_exec_t,s0)
+/usr/bin/logrotate			--	gen_context(system_u:object_r:logrotate_exec_t,s0)
 
-# Systemd unit file
-/usr/lib/systemd/system/[^/]*logrotate.*	--	gen_context(system_u:object_r:logrotate_unit_t,s0)
+/usr/lib/systemd/system/[^/]*logrotate.*  --	gen_context(system_u:object_r:logrotate_unit_t,s0)
 
-/usr/sbin/logrotate	--	gen_context(system_u:object_r:logrotate_exec_t,s0)
+/usr/sbin/logrotate			--	gen_context(system_u:object_r:logrotate_exec_t,s0)
 
-/var/lib/logrotate(/.*)?	gen_context(system_u:object_r:logrotate_var_lib_t,s0)
-/var/lib/logrotate\.status	--	gen_context(system_u:object_r:logrotate_var_lib_t,s0)
+/var/lib/logrotate(/.*)?			gen_context(system_u:object_r:logrotate_var_lib_t,s0)
+/var/lib/(misc/)?logrotate\.status	--	gen_context(system_u:object_r:logrotate_var_lib_t,s0)
Index: refpolicy-2.20180701/policy/modules/admin/logrotate.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/admin/logrotate.te
+++ refpolicy-2.20180701/policy/modules/admin/logrotate.te
@@ -1,4 +1,4 @@
-policy_module(logrotate, 1.21.0)
+policy_module(logrotate, 1.21.4)
 
 ########################################
 #
@@ -38,6 +38,8 @@ role system_r types logrotate_mail_t;
 #
 
 allow logrotate_t self:capability { chown dac_override dac_read_search fowner fsetid kill setgid setuid sys_nice sys_resource };
+# systemctl asks for net_admin
+dontaudit logrotate_t self:capability net_admin;
 allow logrotate_t self:process { transition signal_perms getsched setsched getsession getpgid setpgid getcap setcap share getattr setfscreate noatsecure siginh setrlimit rlimitinh dyntransition setkeycreate setsockcreate getrlimit };
 allow logrotate_t self:fd use;
 allow logrotate_t self:key manage_key_perms;
@@ -92,6 +94,8 @@ fs_search_auto_mountpoints(logrotate_t)
 fs_getattr_xattr_fs(logrotate_t)
 fs_list_inotifyfs(logrotate_t)
 fs_getattr_tmpfs(logrotate_t)
+# killall reads nsfs files
+fs_read_nsfs_files(logrotate_t)
 
 mls_file_read_all_levels(logrotate_t)
 mls_file_write_all_levels(logrotate_t)
@@ -184,7 +188,7 @@ optional_policy(`
 
 optional_policy(`
 	dbus_system_bus_client(logrotate_t)
-	init_write_pid_socket(logrotate_t)
+	init_write_runtime_socket(logrotate_t)
 ')
 
 optional_policy(`
Index: refpolicy-2.20180701/policy/modules/apps/mozilla.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/apps/mozilla.te
+++ refpolicy-2.20180701/policy/modules/apps/mozilla.te
@@ -1,4 +1,4 @@
-policy_module(mozilla, 2.14.0)
+policy_module(mozilla, 2.14.1)
 
 ########################################
 #
@@ -206,6 +206,7 @@ userdom_use_user_ptys(mozilla_t)
 
 userdom_manage_user_tmp_dirs(mozilla_t)
 userdom_manage_user_tmp_files(mozilla_t)
+userdom_map_user_tmp_files(mozilla_t)
 
 userdom_user_content_access_template(mozilla, { mozilla_t mozilla_plugin_t })
 userdom_user_home_dir_filetrans_user_home_content(mozilla_t, { dir file })
@@ -219,6 +220,7 @@ xdg_read_config_files(mozilla_t)
 xdg_read_data_files(mozilla_t)
 xdg_manage_downloads(mozilla_t)
 
+xserver_rw_mesa_shader_cache(mozilla_t)
 xserver_user_x_domain_template(mozilla, mozilla_t, mozilla_tmpfs_t)
 xserver_dontaudit_read_xdm_tmp_files(mozilla_t)
 xserver_dontaudit_getattr_xdm_tmp_sockets(mozilla_t)
@@ -519,6 +521,7 @@ miscfiles_dontaudit_setattr_fonts_cache_
 
 userdom_manage_user_tmp_dirs(mozilla_plugin_t)
 userdom_manage_user_tmp_files(mozilla_plugin_t)
+userdom_map_user_tmp_files(mozilla_plugin_t)
 
 userdom_user_home_dir_filetrans_user_home_content(mozilla_plugin_t, { dir file })
 
Index: refpolicy-2.20180701/policy/modules/kernel/corecommands.fc
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/kernel/corecommands.fc
+++ refpolicy-2.20180701/policy/modules/kernel/corecommands.fc
@@ -181,6 +181,7 @@ ifdef(`distro_gentoo',`
 /usr/lib/ConsoleKit/run-session.d(/.*)?	gen_context(system_u:object_r:bin_t,s0)
 /usr/lib/ConsoleKit/scripts(/.*)?	gen_context(system_u:object_r:bin_t,s0)
 /usr/lib/courier(/.*)?			gen_context(system_u:object_r:bin_t,s0)
+/usr/lib/crda/setregdomain	--	gen_context(system_u:object_r:bin_t,s0)
 /usr/lib/cups(/.*)? 			gen_context(system_u:object_r:bin_t,s0)
 /usr/lib/cyrus/.*		--	gen_context(system_u:object_r:bin_t,s0)
 /usr/lib/cyrus-imapd/.*		--	gen_context(system_u:object_r:bin_t,s0)
@@ -215,6 +216,7 @@ ifdef(`distro_gentoo',`
 /usr/lib/rpm/rpmk		-- 	gen_context(system_u:object_r:bin_t,s0)
 /usr/lib/rpm/rpmq		-- 	gen_context(system_u:object_r:bin_t,s0)
 /usr/lib/rpm/rpmv		-- 	gen_context(system_u:object_r:bin_t,s0)
+/usr/lib/rsyslog/rsyslog-rotate --	gen_context(system_u:object_r:bin_t,s0)
 /usr/lib/security/pam_krb5/pam_krb5_storetmp -- gen_context(system_u:object_r:bin_t,s0)
 /usr/lib/selinux/hll/pp		--	gen_context(system_u:object_r:bin_t,s0)
 /usr/lib/sftp-server		--	gen_context(system_u:object_r:bin_t,s0)
@@ -284,8 +286,8 @@ ifdef(`distro_gentoo',`
 /usr/share/(.*/)?bin(/.*)?		gen_context(system_u:object_r:bin_t,s0)
 /usr/share/ajaxterm/ajaxterm.py.* --	gen_context(system_u:object_r:bin_t,s0)
 /usr/share/ajaxterm/qweb.py.* --	gen_context(system_u:object_r:bin_t,s0)
-/usr/share/apr-0/build/[^/]+\.sh --	gen_context(system_u:object_r:bin_t,s0)
-/usr/share/apr-0/build/libtool --	gen_context(system_u:object_r:bin_t,s0)
+/usr/share/apr(-\d)?/build/[^/]+\.sh --	gen_context(system_u:object_r:bin_t,s0)
+/usr/share/apr(-\d)?/build/libtool --	gen_context(system_u:object_r:bin_t,s0)
 /usr/share/build-1/[^/]+\.sh --		gen_context(system_u:object_r:bin_t,s0)
 /usr/share/build-1/libtool --		gen_context(system_u:object_r:bin_t,s0)
 /usr/share/dayplanner/dayplanner --	gen_context(system_u:object_r:bin_t,s0)
@@ -319,6 +321,7 @@ ifdef(`distro_gentoo',`
 /usr/share/sandbox/sandboxX.sh	--	gen_context(system_u:object_r:bin_t,s0)
 /usr/share/sectool/.*\.py	--	gen_context(system_u:object_r:bin_t,s0)
 /usr/share/selinux/devel/policygentool -- gen_context(system_u:object_r:bin_t,s0)
+/usr/share/smartmontools/.*	--	gen_context(system_u:object_r:bin_t,s0)
 /usr/share/smolt/client(/.*)?		gen_context(system_u:object_r:bin_t,s0)
 /usr/share/shorewall/compiler\.pl --	gen_context(system_u:object_r:bin_t,s0)
 /usr/share/shorewall/configpath	--	gen_context(system_u:object_r:bin_t,s0)
Index: refpolicy-2.20180701/policy/modules/kernel/corecommands.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/kernel/corecommands.te
+++ refpolicy-2.20180701/policy/modules/kernel/corecommands.te
@@ -1,4 +1,4 @@
-policy_module(corecommands, 1.26.0)
+policy_module(corecommands, 1.26.2)
 
 ########################################
 #
Index: refpolicy-2.20180701/policy/modules/kernel/devices.fc
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/kernel/devices.fc
+++ refpolicy-2.20180701/policy/modules/kernel/devices.fc
@@ -120,6 +120,7 @@ ifdef(`distro_suse', `
 ')
 /dev/vfio/.+		-c      gen_context(system_u:object_r:vfio_device_t,s0)
 /dev/vhost-net		-c	gen_context(system_u:object_r:vhost_device_t,s0)
+/dev/vhost-scsi		-c	gen_context(system_u:object_r:vhost_device_t,s0)
 /dev/vbi.*		-c	gen_context(system_u:object_r:v4l_device_t,s0)
 /dev/vbox.*		-c	gen_context(system_u:object_r:xserver_misc_device_t,s0)
 /dev/vga_arbiter	-c	gen_context(system_u:object_r:xserver_misc_device_t,s0)
Index: refpolicy-2.20180701/policy/modules/kernel/devices.if
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/kernel/devices.if
+++ refpolicy-2.20180701/policy/modules/kernel/devices.if
@@ -4839,7 +4839,7 @@ interface(`dev_relabelfrom_vfio_dev',`
 
 ############################
 ## <summary>
-##	Allow read/write the vhost net device
+##	Allow read/write the vhost devices
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -5080,6 +5080,24 @@ interface(`dev_rw_xserver_misc',`
 ')
 
 ########################################
+## <summary>
+##	Map X server miscellaneous devices.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`dev_map_xserver_misc',`
+	gen_require(`
+		type xserver_misc_device_t;
+	')
+
+	allow $1 xserver_misc_device_t:chr_file map;
+')
+
+########################################
 ## <summary>
 ##	Read and write to the zero device (/dev/zero).
 ## </summary>
Index: refpolicy-2.20180701/policy/modules/kernel/devices.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/kernel/devices.te
+++ refpolicy-2.20180701/policy/modules/kernel/devices.te
@@ -1,4 +1,4 @@
-policy_module(devices, 1.23.0)
+policy_module(devices, 1.23.2)
 
 ########################################
 #
@@ -286,7 +286,8 @@ type v4l_device_t;
 dev_node(v4l_device_t)
 
 #
-# vhost_device_t is the type for /dev/vhost-net
+# vhost_device_t is the type for vhost devices like
+# /dev/vhost-net and /dev/vhost-scsi
 #
 type vhost_device_t;
 dev_node(vhost_device_t)
Index: refpolicy-2.20180701/policy/modules/kernel/domain.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/kernel/domain.te
+++ refpolicy-2.20180701/policy/modules/kernel/domain.te
@@ -1,4 +1,4 @@
-policy_module(domain, 1.14.0)
+policy_module(domain, 1.14.1)
 
 ########################################
 #
@@ -137,10 +137,6 @@ optional_policy(`
 	libs_use_shared_libs(domain)
 ')
 
-optional_policy(`
-	setrans_translate_context(domain)
-')
-
 # xdm passes an open file descriptor to xsession-errors.log which is then audited by all confined domains.
 optional_policy(`
 	xserver_dontaudit_use_xdm_fds(domain)
Index: refpolicy-2.20180701/policy/modules/kernel/mls.if
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/kernel/mls.if
+++ refpolicy-2.20180701/policy/modules/kernel/mls.if
@@ -849,7 +849,7 @@ interface(`mls_fd_share_all_levels',`
 ########################################
 ## <summary>
 ##	Make specified domain MLS trusted
-##	for translating contexts at all levels.
+##	for translating contexts at all levels.  (Deprecated)
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -859,11 +859,7 @@ interface(`mls_fd_share_all_levels',`
 ## <rolecap/>
 #
 interface(`mls_context_translate_all_levels',`
-	gen_require(`
-		attribute mlstranslate;
-	')
-
-	typeattribute $1 mlstranslate;
+	refpolicywarn(`$0($*) has been deprecated')
 ')
 
 ########################################
Index: refpolicy-2.20180701/policy/modules/kernel/mls.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/kernel/mls.te
+++ refpolicy-2.20180701/policy/modules/kernel/mls.te
@@ -1,4 +1,4 @@
-policy_module(mls, 1.10.0)
+policy_module(mls, 1.10.1)
 
 ########################################
 #
@@ -69,7 +69,5 @@ attribute mlsrangetrans;
 attribute mlsfduse;
 attribute mlsfdshare;
 
-attribute mlstranslate;
-
 attribute mlsdbusrecv;
 attribute mlsdbussend;
Index: refpolicy-2.20180701/policy/modules/kernel/selinux.if
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/kernel/selinux.if
+++ refpolicy-2.20180701/policy/modules/kernel/selinux.if
@@ -534,6 +534,7 @@ interface(`selinux_compute_access_vector
 	')
 
 	dev_search_sysfs($1)
+	allow $1 self:netlink_selinux_socket create_socket_perms;
 	allow $1 security_t:dir list_dir_perms;
 	allow $1 security_t:file rw_file_perms;
 	allow $1 security_t:security compute_av;
Index: refpolicy-2.20180701/policy/modules/kernel/selinux.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/kernel/selinux.te
+++ refpolicy-2.20180701/policy/modules/kernel/selinux.te
@@ -1,4 +1,4 @@
-policy_module(selinux, 1.15.0)
+policy_module(selinux, 1.15.1)
 
 ########################################
 #
Index: refpolicy-2.20180701/policy/modules/services/amavis.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/services/amavis.te
+++ refpolicy-2.20180701/policy/modules/services/amavis.te
@@ -1,4 +1,4 @@
-policy_module(amavis, 1.18.0)
+policy_module(amavis, 1.18.1)
 
 ########################################
 #
@@ -152,6 +152,7 @@ tunable_policy(`amavis_use_jit',`
 ')
 
 optional_policy(`
+	clamav_scannable_files(amavis_spool_t)
 	clamav_stream_connect(amavis_t)
 	clamav_domtrans_clamscan(amavis_t)
 	clamav_read_state_clamd(amavis_t)
Index: refpolicy-2.20180701/policy/modules/services/apache.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/services/apache.te
+++ refpolicy-2.20180701/policy/modules/services/apache.te
@@ -1,4 +1,4 @@
-policy_module(apache, 2.15.0)
+policy_module(apache, 2.15.1)
 
 ########################################
 #
@@ -1323,6 +1323,7 @@ tunable_policy(`httpd_use_nfs && httpd_b
 
 optional_policy(`
 	clamav_domtrans_clamscan(httpd_sys_script_t)
+	clamav_scannable_files(httpd_sys_content_t)
 ')
 
 optional_policy(`
Index: refpolicy-2.20180701/policy/modules/services/clamav.if
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/services/clamav.if
+++ refpolicy-2.20180701/policy/modules/services/clamav.if
@@ -21,6 +21,32 @@ interface(`clamav_domtrans',`
 
 ########################################
 ## <summary>
+##	Execute clamd programs in the clamd
+##	domain and allow the specified role
+##	the clamd domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed to transition.
+##	</summary>
+## </param>
+## <param name="role">
+##	<summary>
+##	Role allowed access.
+##	</summary>
+## </param>
+#
+interface(`clamav_run',`
+	gen_require(`
+		type clamd_t;
+	')
+
+	clamav_domtrans($1)
+	role $2 types clamd_t;
+')
+
+########################################
+## <summary>
 ##	Connect to clamd using a unix
 ##	domain stream socket.
 ## </summary>
@@ -35,6 +61,8 @@ interface(`clamav_stream_connect',`
 		type clamd_t, clamd_var_run_t;
 	')
 
+	allow clamd_t $1:fd use;
+
 	files_search_pids($1)
 	stream_connect_pattern($1, clamd_var_run_t, clamd_var_run_t, clamd_t)
 ')
@@ -177,6 +205,128 @@ interface(`clamav_read_state_clamd',`
 	read_lnk_files_pattern($1, clamd_t, clamd_t)
 ')
 
+#######################################
+## <summary>
+##	Read clam virus signature files
+## </summary>
+## <desc>
+##	<p>
+##	Useful for when using things like 'sigtool'
+##	which provides useful information about
+##	ClamAV signature files.
+##	</p>
+## </desc>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`clamav_read_signatures',`
+	gen_require(`
+		type clamd_var_lib_t;
+	')
+
+	clamav_search_lib($1)
+	allow $1 clamd_var_lib_t:dir list_dir_perms;
+	read_files_pattern($1, clamd_var_lib_t, clamd_var_lib_t)
+	read_lnk_files_pattern($1, clamd_var_lib_t, clamd_var_lib_t)
+')
+
+#######################################
+## <summary>
+##	Denote a particular type to be scanned by ClamAV
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Type that clamd_t and clamscan_t can read.
+##	</summary>
+## </param>
+#
+interface(`clamav_scannable_files',`
+	gen_require(`
+		attribute clam_scannable_type;
+	')
+
+	typeattribute $1 clam_scannable_type;
+')
+
+########################################
+## <summary>
+##	Allow specified domain to enable clamd units
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`clamav_enabledisable_clamd',`
+	gen_require(`
+		type clamav_unit_t;
+		class service { enable disable };
+	')
+
+	allow $1 clamav_unit_t:service { enable disable };
+')
+
+########################################
+## <summary>
+##	Allow specified domain to start clamd units
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`clamav_startstop_clamd',`
+	gen_require(`
+		type clamd_unit_t;
+		class service { start stop };
+	')
+
+	allow $1 clamd_unit_t:service { start stop };
+')
+
+########################################
+## <summary>
+##	Allow specified domain to get status of clamd
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`clamav_status_clamd',`
+	gen_require(`
+		type clamd_unit_t;
+		class service status;
+	')
+
+	allow $1 clamd_unit_t:service status;
+')
+
+########################################
+## <summary>
+##	Allow specified domain reload of clamd
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`clamav_reload_clamd',`
+	gen_require(`
+		type clamd_unit_t;
+		class service reload;
+	')
+
+	allow $1 clamd_unit_t:service reload;
+')
+
 ########################################
 ## <summary>
 ##	All of the rules required to
Index: refpolicy-2.20180701/policy/modules/services/clamav.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/services/clamav.te
+++ refpolicy-2.20180701/policy/modules/services/clamav.te
@@ -1,4 +1,4 @@
-policy_module(clamav, 1.15.0)
+policy_module(clamav, 1.15.3)
 
 ## <desc>
 ##	<p>
@@ -27,6 +27,7 @@ gen_tunable(clamd_use_jit, false)
 #
 # Declarations
 #
+attribute clam_scannable_type;
 
 type clamd_t;
 type clamd_exec_t;
@@ -103,7 +104,12 @@ manage_files_pattern(clamd_t, clamd_var_
 manage_sock_files_pattern(clamd_t, clamd_var_run_t, clamd_var_run_t)
 files_pid_filetrans(clamd_t, clamd_var_run_t, { dir file sock_file })
 
+read_files_pattern(clamd_t, clam_scannable_type, clam_scannable_type)
+read_lnk_files_pattern(clamd_t, clam_scannable_type, clam_scannable_type)
+list_dirs_pattern(clamd_t, clam_scannable_type, clam_scannable_type)
+
 kernel_dontaudit_list_proc(clamd_t)
+kernel_read_crypto_sysctls(clamd_t)
 kernel_read_sysctl(clamd_t)
 kernel_read_kernel_sysctls(clamd_t)
 kernel_read_system_state(clamd_t)
@@ -151,7 +157,6 @@ tunable_policy(`clamd_use_jit',`
 
 optional_policy(`
 	amavis_read_lib_files(clamd_t)
-	amavis_read_spool_files(clamd_t)
 	amavis_spool_filetrans(clamd_t, clamd_var_run_t, sock_file)
 	amavis_create_pid_files(clamd_t)
 ')
@@ -163,10 +168,6 @@ optional_policy(`
 ')
 
 optional_policy(`
-	exim_read_spool_files(clamd_t)
-')
-
-optional_policy(`
 	mta_read_config(clamd_t)
 	mta_send_mail(clamd_t)
 ')
@@ -273,6 +274,10 @@ manage_dirs_pattern(clamscan_t, clamscan
 manage_files_pattern(clamscan_t, clamscan_tmp_t, clamscan_tmp_t)
 files_tmp_filetrans(clamscan_t, clamscan_tmp_t, { dir file })
 
+read_files_pattern(clamscan_t, clam_scannable_type, clam_scannable_type)
+read_lnk_files_pattern(clamscan_t, clam_scannable_type, clam_scannable_type)
+list_dirs_pattern(clamscan_t, clam_scannable_type, clam_scannable_type)
+
 allow clamscan_t clamd_var_lib_t:dir list_dir_perms;
 manage_files_pattern(clamscan_t, clamd_var_lib_t, clamd_var_lib_t)
 
@@ -320,14 +325,5 @@ tunable_policy(`clamav_read_all_non_secu
 ')
 
 optional_policy(`
-	amavis_read_spool_files(clamscan_t)
-')
-
-optional_policy(`
-	apache_read_sys_content(clamscan_t)
-')
-
-optional_policy(`
 	mta_send_mail(clamscan_t)
-	mta_read_queue(clamscan_t)
 ')
Index: refpolicy-2.20180701/policy/modules/services/cron.if
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/services/cron.if
+++ refpolicy-2.20180701/policy/modules/services/cron.if
@@ -708,6 +708,26 @@ interface(`cron_manage_system_spool',`
 
 ########################################
 ## <summary>
+##      Read the system spool.
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+#
+interface(`cron_read_system_spool',`
+	gen_require(`
+		type system_cron_spool_t;
+	')
+
+	cron_search_spool($1)
+	list_dirs_pattern($1, system_cron_spool_t, system_cron_spool_t)
+	read_files_pattern($1, system_cron_spool_t, system_cron_spool_t)
+')
+
+########################################
+## <summary>
 ##      Read and write crond temporary files.
 ## </summary>
 ## <param name="domain">
Index: refpolicy-2.20180701/policy/modules/services/cron.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/services/cron.te
+++ refpolicy-2.20180701/policy/modules/services/cron.te
@@ -1,4 +1,4 @@
-policy_module(cron, 2.14.0)
+policy_module(cron, 2.14.3)
 
 gen_require(`
 	class passwd rootok;
@@ -339,6 +339,7 @@ ifdef(`distro_debian',`
 	allow crond_t self:process setrlimit;
 
 	optional_policy(`
+		apt_domtrans(system_cronjob_t)
 		apt_manage_cache(system_cronjob_t)
 		apt_read_db(system_cronjob_t)
 
@@ -378,6 +379,10 @@ optional_policy(`
 	')
 
 	optional_policy(`
+		init_dbus_chat(crond_t)
+	')
+
+	optional_policy(`
 		unconfined_dbus_send(crond_t)
 	')
 ')
@@ -433,6 +438,8 @@ optional_policy(`
 ')
 
 optional_policy(`
+	init_dbus_chat(crond_t)
+	init_dbus_chat(system_cronjob_t)
 	systemd_dbus_chat_logind(system_cronjob_t)
 	systemd_write_inherited_logind_sessions_pipes(system_cronjob_t)
 	# so cron jobs can restart daemons
@@ -455,7 +462,7 @@ allow system_cronjob_t self:fd use;
 allow system_cronjob_t self:fifo_file rw_fifo_file_perms;
 allow system_cronjob_t self:passwd rootok;
 
-allow system_cronjob_t cron_log_t:file { append_file_perms create_file_perms setattr_file_perms };
+allow system_cronjob_t cron_log_t:file manage_file_perms;
 logging_log_filetrans(system_cronjob_t, cron_log_t, file)
 
 allow system_cronjob_t cron_var_lib_t:file { manage_file_perms relabel_file_perms };
@@ -487,6 +494,11 @@ allow system_cronjob_t cron_spool_t:file
 
 allow system_cronjob_t crond_tmp_t:file rw_inherited_file_perms;
 
+# popcon wants to stat /proc/kmsg and /proc/kcore
+kernel_getattr_core_if(system_cronjob_t)
+kernel_getattr_message_if(system_cronjob_t)
+
+kernel_read_crypto_sysctls(system_cronjob_t)
 kernel_read_kernel_sysctls(system_cronjob_t)
 kernel_read_network_state(system_cronjob_t)
 kernel_read_system_state(system_cronjob_t)
@@ -507,8 +519,11 @@ corenet_udp_sendrecv_all_ports(system_cr
 
 dev_getattr_all_blk_files(system_cronjob_t)
 dev_getattr_all_chr_files(system_cronjob_t)
+dev_getattr_mtrr_dev(system_cronjob_t)
 dev_read_urand(system_cronjob_t)
 dev_read_sysfs(system_cronjob_t)
+# for checkarray to write to sync_action
+dev_rw_sysfs(system_cronjob_t)
 
 fs_getattr_all_fs(system_cronjob_t)
 fs_getattr_all_files(system_cronjob_t)
@@ -531,6 +546,7 @@ files_read_var_files(system_cronjob_t)
 files_dontaudit_search_pids(system_cronjob_t)
 files_manage_generic_spool(system_cronjob_t)
 files_create_boot_flag(system_cronjob_t)
+files_read_var_lib_symlinks(system_cronjob_t)
 
 mls_file_read_to_clearance(system_cronjob_t)
 
Index: refpolicy-2.20180701/policy/modules/services/dbus.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/services/dbus.te
+++ refpolicy-2.20180701/policy/modules/services/dbus.te
@@ -1,4 +1,4 @@
-policy_module(dbus, 1.25.0)
+policy_module(dbus, 1.25.4)
 
 gen_require(`
 	class dbus all_dbus_perms;
@@ -89,6 +89,7 @@ files_pid_filetrans(system_dbusd_t, syst
 
 can_exec(system_dbusd_t, dbusd_exec_t)
 
+kernel_read_crypto_sysctls(system_dbusd_t)
 kernel_read_system_state(system_dbusd_t)
 kernel_read_kernel_sysctls(system_dbusd_t)
 
@@ -157,6 +158,10 @@ ifdef(`init_systemd', `
 	# gdm3 causes system_dbusd_t to want this access
 	dev_rw_dri(system_dbusd_t)
 	dev_rw_input_dev(system_dbusd_t)
+
+	# for /run/systemd/dynamic-uid/
+	init_list_pids(system_dbusd_t)
+	init_read_runtime_symlinks(system_dbusd_t)
 ')
 
 optional_policy(`
@@ -227,6 +232,7 @@ manage_files_pattern(session_bus_type, s
 manage_sock_files_pattern(session_bus_type, session_dbusd_runtime_t, session_dbusd_runtime_t)
 userdom_user_runtime_filetrans(session_bus_type, session_dbusd_runtime_t, { dir file sock_file })
 
+kernel_read_crypto_sysctls(session_bus_type)
 kernel_read_system_state(session_bus_type)
 kernel_read_kernel_sysctls(session_bus_type)
 
Index: refpolicy-2.20180701/policy/modules/services/dnsmasq.fc
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/services/dnsmasq.fc
+++ refpolicy-2.20180701/policy/modules/services/dnsmasq.fc
@@ -1,19 +1,19 @@
-/etc/dnsmasq\.conf	--	gen_context(system_u:object_r:dnsmasq_etc_t,s0)
-/etc/dnsmasq\.d(/.*)?   gen_context(system_u:object_r:dnsmasq_etc_t,s0)
+/etc/dnsmasq\.conf		--	gen_context(system_u:object_r:dnsmasq_etc_t,s0)
+/etc/dnsmasq\.d(/.*)?			gen_context(system_u:object_r:dnsmasq_etc_t,s0)
 
 /etc/rc\.d/init\.d/dnsmasq	--	gen_context(system_u:object_r:dnsmasq_initrc_exec_t,s0)
 
-/usr/bin/dnsmasq	--	gen_context(system_u:object_r:dnsmasq_exec_t,s0)
+/run/dnsmasq.*			--	gen_context(system_u:object_r:dnsmasq_var_run_t,s0)
+/run/libvirt/network(/.*)?		gen_context(system_u:object_r:dnsmasq_var_run_t,s0)
+
+/usr/bin/dnsmasq		--	gen_context(system_u:object_r:dnsmasq_exec_t,s0)
 
 # Systemd unit file
-/usr/lib/systemd/system/[^/]*dnsmasq.*	--	gen_context(system_u:object_r:dnsmasq_unit_t,s0)
+/usr/lib/systemd/system/[^/]*dnsmasq.* -- gen_context(system_u:object_r:dnsmasq_unit_t,s0)
 
-/usr/sbin/dnsmasq	--	gen_context(system_u:object_r:dnsmasq_exec_t,s0)
+/usr/sbin/dnsmasq		--	gen_context(system_u:object_r:dnsmasq_exec_t,s0)
 
 /var/lib/misc/dnsmasq\.leases	--	gen_context(system_u:object_r:dnsmasq_lease_t,s0)
-/var/lib/dnsmasq(/.*)?	gen_context(system_u:object_r:dnsmasq_lease_t,s0)
-
-/var/log/dnsmasq.*	--	gen_context(system_u:object_r:dnsmasq_var_log_t,s0)
+/var/lib/dnsmasq(/.*)?			gen_context(system_u:object_r:dnsmasq_lease_t,s0)
 
-/run/dnsmasq.*	--	gen_context(system_u:object_r:dnsmasq_var_run_t,s0)
-/run/libvirt/network(/.*)?	gen_context(system_u:object_r:dnsmasq_var_run_t,s0)
+/var/log/dnsmasq(.*)?\.log(\..+)	--	gen_context(system_u:object_r:dnsmasq_var_log_t,s0)
Index: refpolicy-2.20180701/policy/modules/services/dnsmasq.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/services/dnsmasq.te
+++ refpolicy-2.20180701/policy/modules/services/dnsmasq.te
@@ -1,4 +1,4 @@
-policy_module(dnsmasq, 1.16.0)
+policy_module(dnsmasq, 1.16.1)
 
 ########################################
 #
Index: refpolicy-2.20180701/policy/modules/services/exim.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/services/exim.te
+++ refpolicy-2.20180701/policy/modules/services/exim.te
@@ -1,4 +1,4 @@
-policy_module(exim, 1.12.0)
+policy_module(exim, 1.12.1)
 
 ########################################
 #
@@ -189,6 +189,7 @@ tunable_policy(`exim_manage_user_files',
 
 optional_policy(`
 	clamav_domtrans_clamscan(exim_t)
+	clamav_scannable_files(exim_spool_t)
 	clamav_stream_connect(exim_t)
 ')
 
Index: refpolicy-2.20180701/policy/modules/services/irqbalance.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/services/irqbalance.te
+++ refpolicy-2.20180701/policy/modules/services/irqbalance.te
@@ -1,4 +1,4 @@
-policy_module(irqbalance, 1.10.0)
+policy_module(irqbalance, 1.10.2)
 
 ########################################
 #
@@ -28,6 +28,7 @@ allow irqbalance_t self:capability { set
 dontaudit irqbalance_t self:capability sys_tty_config;
 allow irqbalance_t self:process { getcap getsched setcap signal_perms };
 allow irqbalance_t self:udp_socket create_socket_perms;
+allow irqbalance_t self:unix_stream_socket create_stream_socket_perms;
 
 manage_files_pattern(irqbalance_t, irqbalance_pid_t, irqbalance_pid_t)
 files_pid_filetrans(irqbalance_t, irqbalance_pid_t, file)
@@ -44,6 +45,7 @@ files_read_etc_runtime_files(irqbalance_
 
 fs_getattr_all_fs(irqbalance_t)
 fs_search_auto_mountpoints(irqbalance_t)
+fs_search_tmpfs(irqbalance_t)
 
 domain_use_interactive_fds(irqbalance_t)
 
Index: refpolicy-2.20180701/policy/modules/services/minissdpd.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/services/minissdpd.te
+++ refpolicy-2.20180701/policy/modules/services/minissdpd.te
@@ -1,4 +1,4 @@
-policy_module(minissdpd, 1.4.0)
+policy_module(minissdpd, 1.4.1)
 
 ########################################
 #
@@ -27,6 +27,7 @@ allow minissdpd_t self:capability { net_
 allow minissdpd_t self:netlink_route_socket r_netlink_socket_perms;
 allow minissdpd_t self:udp_socket create_socket_perms;
 allow minissdpd_t self:unix_dgram_socket create_socket_perms;
+allow minissdpd_t self:unix_stream_socket create_stream_socket_perms;
 
 allow minissdpd_t minissdpd_var_run_t:file manage_file_perms;
 allow minissdpd_t minissdpd_var_run_t:sock_file manage_sock_file_perms;
@@ -48,4 +49,4 @@ corenet_udp_sendrecv_ssdp_port(minissdpd
 
 logging_send_syslog_msg(minissdpd_t)
 
-miscfiles_read_localization(minissdpd_t)
\ No newline at end of file
+miscfiles_read_localization(minissdpd_t)
Index: refpolicy-2.20180701/policy/modules/services/mta.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/services/mta.te
+++ refpolicy-2.20180701/policy/modules/services/mta.te
@@ -1,4 +1,4 @@
-policy_module(mta, 2.11.0)
+policy_module(mta, 2.11.1)
 
 ########################################
 #
@@ -233,6 +233,7 @@ optional_policy(`
 ')
 
 optional_policy(`
+	clamav_scannable_files(mqueue_spool_t)
 	clamav_stream_connect(system_mail_t)
 	clamav_append_log(system_mail_t)
 ')
Index: refpolicy-2.20180701/policy/modules/services/ntp.if
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/services/ntp.if
+++ refpolicy-2.20180701/policy/modules/services/ntp.if
@@ -179,6 +179,69 @@ interface(`ntp_rw_shm',`
 
 ########################################
 ## <summary>
+##	Allow specified domain to enable/disable ntpd unit
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`ntp_enabledisable',`
+	ifdef(`init_systemd',`
+		gen_require(`
+			type ntpd_unit_t;
+			class service { enable disable };
+		')
+
+		allow $1 ntpd_unit_t:service { enable disable };
+	')
+')
+
+########################################
+## <summary>
+##	Allow specified domain to start/stop ntpd unit
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`ntp_startstop',`
+	ifdef(`init_systemd',`
+		gen_require(`
+			type ntpd_unit_t;
+			class service { start stop };
+		')
+
+		allow $1 ntpd_unit_t:service { start stop };
+	')
+')
+
+########################################
+## <summary>
+##	Allow specified domain to get status of ntpd unit
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`ntp_status',`
+	ifdef(`init_systemd',`
+		gen_require(`
+			type ntpd_unit_t;
+			class service status;
+		')
+
+		allow $1 ntpd_unit_t:service status;
+	')
+')
+
+########################################
+## <summary>
 ##	All of the rules required to
 ##	administrate an ntp environment.
 ## </summary>
Index: refpolicy-2.20180701/policy/modules/services/ntp.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/services/ntp.te
+++ refpolicy-2.20180701/policy/modules/services/ntp.te
@@ -1,4 +1,4 @@
-policy_module(ntp, 1.18.0)
+policy_module(ntp, 1.18.6)
 
 ########################################
 #
@@ -73,9 +73,8 @@ read_lnk_files_pattern(ntpd_t, ntpd_key_
 allow ntpd_t ntpd_lock_t:file rw_file_perms;
 
 allow ntpd_t ntpd_log_t:dir setattr_dir_perms;
-append_files_pattern(ntpd_t, ntpd_log_t, ntpd_log_t)
-create_files_pattern(ntpd_t, ntpd_log_t, ntpd_log_t)
-setattr_files_pattern(ntpd_t, ntpd_log_t, ntpd_log_t)
+manage_dirs_pattern(ntpd_t, ntpd_log_t, ntpd_log_t)
+manage_files_pattern(ntpd_t, ntpd_log_t, ntpd_log_t)
 logging_log_filetrans(ntpd_t, ntpd_log_t, { file dir })
 
 manage_files_pattern(ntpd_t, ntpd_pid_t, ntpd_pid_t)
@@ -142,14 +141,17 @@ ifdef(`init_systemd',`
 	dbus_connect_system_bus(ntpd_t)
 	init_dbus_chat(ntpd_t)
 	init_get_system_status(ntpd_t)
+	# for /var/lib/systemd/timesync
+	init_read_var_lib_links(ntpd_t)
 	allow ntpd_t self:capability { fowner setpcap };
+	init_read_state(ntpd_t)
 	init_reload(ntpd_t)
 
 	# for /var/lib/systemd/clock
 	init_list_var_lib_dirs(ntpd_t)
 
 	# for /run/systemd/netif/links
-	init_list_pids(ntpd_t)
+	systemd_list_networkd_runtime(ntpd_t)
 
 	optional_policy(`
 		unconfined_dbus_send(ntpd_t)
Index: refpolicy-2.20180701/policy/modules/services/ssh.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/services/ssh.te
+++ refpolicy-2.20180701/policy/modules/services/ssh.te
@@ -1,4 +1,4 @@
-policy_module(ssh, 2.11.0)
+policy_module(ssh, 2.11.4)
 
 ########################################
 #
@@ -156,6 +156,7 @@ corenet_tcp_connect_ssh_port(ssh_t)
 corenet_sendrecv_ssh_client_packets(ssh_t)
 
 dev_read_urand(ssh_t)
+dev_dontaudit_read_rand(ssh_t)
 
 fs_getattr_all_fs(ssh_t)
 fs_search_auto_mountpoints(ssh_t)
@@ -247,6 +248,9 @@ optional_policy(`
 # sshd_t is the domain for the sshd program.
 #
 
+# for /run/user/UID/bus access, probably pam_systemd.so
+allow sshd_t self:capability dac_read_search;
+
 # so a tunnel can point to another ssh tunnel
 allow sshd_t self:netlink_route_socket r_netlink_socket_perms;
 allow sshd_t self:key { search link write };
@@ -274,6 +278,7 @@ ifdef(`distro_debian',`
 ')
 
 ifdef(`init_systemd',`
+	init_dbus_chat(sshd_t)
 	systemd_dbus_chat_logind(sshd_t)
 	init_rw_stream_sockets(sshd_t)
 ')
@@ -328,6 +333,7 @@ optional_policy(`
 
 optional_policy(`
 	xserver_domtrans_xauth(sshd_t)
+	xserver_link_xdm_keys(sshd_t)
 ')
 
 ########################################
@@ -352,6 +358,7 @@ fs_search_auto_mountpoints(ssh_keygen_t)
 
 dev_read_sysfs(ssh_keygen_t)
 dev_read_urand(ssh_keygen_t)
+dev_dontaudit_read_rand(ssh_keygen_t)
 
 term_dontaudit_use_console(ssh_keygen_t)
 
Index: refpolicy-2.20180701/policy/modules/services/xserver.fc
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/services/xserver.fc
+++ refpolicy-2.20180701/policy/modules/services/xserver.fc
@@ -2,6 +2,7 @@
 # HOME_DIR
 #
 HOME_DIR/\.cache/mesa_shader_cache(/.*)?	gen_context(system_u:object_r:mesa_shader_cache_t,s0)
+HOME_DIR/\.cache/fontconfig(/.*)?	gen_context(system_u:object_r:user_fonts_cache_t,s0)
 HOME_DIR/\.dmrc		--	gen_context(system_u:object_r:dmrc_home_t,s0)
 HOME_DIR/\.fonts\.conf	--	gen_context(system_u:object_r:user_fonts_config_t,s0)
 HOME_DIR/\.fonts(/.*)?		gen_context(system_u:object_r:user_fonts_t,s0)
Index: refpolicy-2.20180701/policy/modules/services/xserver.if
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/services/xserver.if
+++ refpolicy-2.20180701/policy/modules/services/xserver.if
@@ -82,6 +82,7 @@ interface(`xserver_restricted_role',`
 	allow $2 xserver_tmp_t:file { getattr read };
 
 	dev_rw_xserver_misc($2)
+	dev_map_xserver_misc($2)
 	dev_rw_power_management($2)
 	dev_read_input($2)
 	dev_read_misc($2)
@@ -505,17 +506,19 @@ interface(`xserver_use_user_fonts',`
 
 	# Read per user fonts
 	allow $1 user_fonts_t:dir list_dir_perms;
-	allow $1 user_fonts_t:file read_file_perms;
+	allow $1 user_fonts_t:file { map read_file_perms };
 
 	# Manipulate the global font cache
 	manage_dirs_pattern($1, user_fonts_cache_t, user_fonts_cache_t)
 	manage_files_pattern($1, user_fonts_cache_t, user_fonts_cache_t)
+	allow $1 user_fonts_cache_t:file { map read_file_perms };
 
 	# Read per user font config
 	allow $1 user_fonts_config_t:dir list_dir_perms;
 	allow $1 user_fonts_config_t:file read_file_perms;
 
 	userdom_search_user_home_dirs($1)
+	xdg_search_cache_dirs($1)
 ')
 
 ########################################
@@ -1630,6 +1633,24 @@ interface(`xserver_rw_xdm_keys',`
 ')
 
 ########################################
+## <summary>
+##	Manage keys for xdm.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`xserver_link_xdm_keys',`
+	gen_require(`
+		type xdm_t;
+	')
+
+	allow $1 xdm_t:key link;
+')
+
+########################################
 ## <summary>
 ##	Read and write the mesa shader cache.
 ## </summary>
Index: refpolicy-2.20180701/policy/modules/services/xserver.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/services/xserver.te
+++ refpolicy-2.20180701/policy/modules/services/xserver.te
@@ -1,4 +1,4 @@
-policy_module(xserver, 3.16.0)
+policy_module(xserver, 3.16.6)
 
 gen_require(`
 	class x_drawable all_x_drawable_perms;
@@ -125,7 +125,7 @@ userdom_user_home_content(user_fonts_t)
 type user_fonts_cache_t;
 typealias user_fonts_cache_t alias { staff_fonts_cache_t sysadm_fonts_cache_t };
 typealias user_fonts_cache_t alias { auditadm_fonts_cache_t secadm_fonts_cache_t };
-userdom_user_home_content(user_fonts_cache_t)
+xdg_cache_content(user_fonts_cache_t)
 
 type user_fonts_config_t;
 typealias user_fonts_config_t alias { staff_fonts_config_t sysadm_fonts_config_t };
@@ -289,6 +289,8 @@ allow xauth_t xdm_t:unix_stream_socket {
 
 kernel_request_load_module(xauth_t)
 
+dev_read_sysfs(xauth_t)
+
 domain_use_interactive_fds(xauth_t)
 
 files_read_etc_files(xauth_t)
@@ -484,7 +486,6 @@ term_setattr_unallocated_ttys(xdm_t)
 auth_domtrans_pam_console(xdm_t)
 auth_manage_pam_pid(xdm_t)
 auth_manage_pam_console_data(xdm_t)
-auth_rw_faillog(xdm_t)
 auth_write_login_records(xdm_t)
 
 # Run telinit->init to shutdown.
@@ -566,12 +567,19 @@ optional_policy(`
 ')
 
 optional_policy(`
+	allow xdm_t self:process getcap;
+
+	dbus_exec(xdm_t)
 	dbus_system_bus_client(xdm_t)
 	dbus_connect_system_bus(xdm_t)
 
 	optional_policy(`
 		accountsd_dbus_chat(xdm_t)
 	')
+
+	optional_policy(`
+		systemd_read_logind_pids(xdm_t)
+	')
 ')
 
 optional_policy(`
@@ -702,6 +710,9 @@ allow xserver_t mesa_shader_cache_t:file
 xdg_cache_filetrans(xserver_t, mesa_shader_cache_t, dir, "mesa_shader_cache")
 xdg_generic_user_home_dir_filetrans_cache(xserver_t, dir, ".cache")
 
+# for writing to ~/.local/share/sddm/xorg-session.log
+xdg_manage_data(xauth_t)
+
 domtrans_pattern(xserver_t, xauth_exec_t, xauth_t)
 allow xserver_t xauth_home_t:file read_file_perms;
 
@@ -709,6 +720,7 @@ allow xserver_t xauth_home_t:file read_f
 manage_files_pattern(xserver_t, xserver_log_t, xserver_log_t)
 logging_log_filetrans(xserver_t, xserver_log_t, file)
 
+kernel_read_crypto_sysctls(xserver_t)
 kernel_read_system_state(xserver_t)
 kernel_read_device_sysctls(xserver_t)
 kernel_read_modprobe_sysctls(xserver_t)
@@ -749,6 +761,7 @@ dev_read_raw_memory(xserver_t)
 dev_wx_raw_memory(xserver_t)
 # for other device nodes such as the NVidia binary-only driver
 dev_rw_xserver_misc(xserver_t)
+dev_map_xserver_misc(xserver_t)
 # read events - the synaptics touchpad driver reads raw events
 dev_rw_input_dev(xserver_t)
 dev_rwx_zero(xserver_t)
Index: refpolicy-2.20180701/policy/modules/system/fstools.fc
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/system/fstools.fc
+++ refpolicy-2.20180701/policy/modules/system/fstools.fc
@@ -11,6 +11,7 @@
 /usr/bin/e2fsck			--	gen_context(system_u:object_r:fsadm_exec_t,s0)
 /usr/bin/e4fsck			--	gen_context(system_u:object_r:fsadm_exec_t,s0)
 /usr/bin/e2label		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
+/usr/bin/e2mmpstatus		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
 /usr/bin/efibootmgr		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
 /usr/bin/fatsort		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
 /usr/bin/fdisk			--	gen_context(system_u:object_r:fsadm_exec_t,s0)
@@ -67,6 +68,7 @@
 /usr/sbin/e2fsck		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
 /usr/sbin/e4fsck		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
 /usr/sbin/e2label		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
+/usr/sbin/e2mmpstatus		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
 /usr/sbin/efibootmgr		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
 /usr/sbin/fatsort		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
 /usr/sbin/fdisk			--	gen_context(system_u:object_r:fsadm_exec_t,s0)
Index: refpolicy-2.20180701/policy/modules/system/fstools.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/system/fstools.te
+++ refpolicy-2.20180701/policy/modules/system/fstools.te
@@ -1,4 +1,4 @@
-policy_module(fstools, 1.22.0)
+policy_module(fstools, 1.22.1)
 
 ########################################
 #
Index: refpolicy-2.20180701/policy/modules/system/init.if
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/system/init.if
+++ refpolicy-2.20180701/policy/modules/system/init.if
@@ -204,8 +204,11 @@ interface(`init_spec_daemon_domain',`
 	gen_require(`
 		type init_t;
 		role system_r;
+		attribute daemon;
 	')
 
+	typeattribute $1 daemon;
+
 	domain_type($1)
 	domain_entry_file($1, $2)
 
@@ -1131,6 +1134,25 @@ interface(`init_dbus_chat',`
 
 ########################################
 ## <summary>
+##      read/follow symlinks under /var/lib/systemd/
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+#
+interface(`init_read_var_lib_links',`
+	gen_require(`
+		type init_var_lib_t;
+	')
+
+	allow $1 init_var_lib_t:dir list_dir_perms;
+	allow $1 init_var_lib_t:lnk_file read_lnk_file_perms;
+')
+
+########################################
+## <summary>
 ##      List /var/lib/systemd/ dir
 ## </summary>
 ## <param name="domain">
@@ -1301,23 +1323,13 @@ interface(`init_pid_filetrans',`
 ## </param>
 #
 interface(`init_getattr_initctl',`
-	ifdef(`init_systemd',`
-		# stat /run/systemd/initctl/fifo
-		gen_require(`
-			type init_var_run_t;
-		')
-
-		allow $1 init_var_run_t:fifo_file getattr;
-		allow $1 init_var_run_t:dir list_dir_perms;
-	',`
-		gen_require(`
-			type initctl_t;
-		')
-
-		dev_list_all_dev_nodes($1)
-		files_search_pids($1)
-		allow $1 initctl_t:fifo_file getattr;
+	gen_require(`
+		type initctl_t;
 	')
+
+	files_search_pids($1)
+	dev_list_all_dev_nodes($1)
+	allow $1 initctl_t:fifo_file getattr;
 ')
 
 ########################################
@@ -1856,6 +1868,25 @@ interface(`init_ptrace',`
 
 ########################################
 ## <summary>
+##	get init process stats
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`init_getattr',`
+	gen_require(`
+		type init_t;
+	')
+
+	allow $1 init_t:process getattr;
+')
+
+########################################
+## <summary>
 ##	Write an init script unnamed pipe.
 ## </summary>
 ## <param name="domain">
@@ -2660,6 +2691,22 @@ interface(`init_relabel_utmp',`
 ## </param>
 #
 interface(`init_pid_filetrans_utmp',`
+	refpolicywarn(`$0($*) has been deprecated, please use init_runtime_filetrans_utmp() instead.')
+	init_runtime_filetrans_utmp($1)
+')
+
+########################################
+## <summary>
+##	Create files in /var/run with the
+##	utmp file type.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`init_runtime_filetrans_utmp',`
 	gen_require(`
 		type initrc_var_run_t;
 	')
@@ -2678,6 +2725,21 @@ interface(`init_pid_filetrans_utmp',`
 ## </param>
 #
 interface(`init_create_pid_dirs',`
+	refpolicywarn(`$0($*) has been deprecated, please use init_create_runtime_dirs() instead.')
+	init_create_runtime_dirs($1)
+')
+
+#######################################
+## <summary>
+##	Create a directory in the /run/systemd directory.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`init_create_runtime_dirs',`
 	gen_require(`
 		type init_var_run_t;
 	')
@@ -2697,6 +2759,21 @@ interface(`init_create_pid_dirs',`
 ## </param>
 #
 interface(`init_rename_pid_files',`
+	refpolicywarn(`$0($*) has been deprecated, please use init_rename_runtime_files() instead.')
+	init_rename_runtime_files($1)
+')
+
+########################################
+## <summary>
+##      Rename init_var_run_t files
+## </summary>
+## <param name="domain">
+##      <summary>
+##      domain
+##      </summary>
+## </param>
+#
+interface(`init_rename_runtime_files',`
 	gen_require(`
 		type init_var_run_t;
 	')
@@ -2706,7 +2783,7 @@ interface(`init_rename_pid_files',`
 
 ########################################
 ## <summary>
-##      Rename and de init_var_run_t files
+##      Delete init_var_run_t files
 ## </summary>
 ## <param name="domain">
 ##      <summary>
@@ -2715,6 +2792,21 @@ interface(`init_rename_pid_files',`
 ## </param>
 #
 interface(`init_delete_pid_files',`
+	refpolicywarn(`$0($*) has been deprecated, please use init_delete_runtime_files() instead.')
+	init_delete_runtime_files($1)
+')
+
+########################################
+## <summary>
+##      Delete init_var_run_t files
+## </summary>
+## <param name="domain">
+##      <summary>
+##      domain
+##      </summary>
+## </param>
+#
+interface(`init_delete_runtime_files',`
 	gen_require(`
 		type init_var_run_t;
 	')
@@ -2734,6 +2826,22 @@ interface(`init_delete_pid_files',`
 ## </param>
 #
 interface(`init_write_pid_socket',`
+	refpolicywarn(`$0($*) has been deprecated, please use init_write_runtime_socket() instead.')
+	init_write_runtime_socket($1)
+')
+
+#######################################
+## <summary>
+##  Allow the specified domain to write to
+##  init sock file.
+## </summary>
+## <param name="domain">
+##  <summary>
+##  Domain allowed access.
+##  </summary>
+## </param>
+#
+interface(`init_write_runtime_socket',`
 	gen_require(`
 		type init_var_run_t;
 	')
@@ -2752,6 +2860,21 @@ interface(`init_write_pid_socket',`
 ## </param>
 #
 interface(`init_read_pid_pipes',`
+	refpolicywarn(`$0($*) has been deprecated, please use init_read_runtime_pipes() instead.')
+	init_read_runtime_pipes($1)
+')
+
+########################################
+## <summary>
+##	Read init unnamed pipes.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`init_read_runtime_pipes',`
 	gen_require(`
 		type init_var_run_t;
 	')
@@ -2759,6 +2882,24 @@ interface(`init_read_pid_pipes',`
 	read_fifo_files_pattern($1, init_var_run_t, init_var_run_t)
 ')
 
+######################################
+## <summary>
+##	read systemd unit symlinks (usually under /run/systemd/units/)
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`init_read_runtime_symlinks',`
+	gen_require(`
+		type init_var_run_t;
+	')
+
+	read_lnk_files_pattern($1, init_var_run_t, init_var_run_t)
+')
+
 ########################################
 ## <summary>
 ##	Allow the specified domain to connect to daemon with a tcp socket
@@ -3027,3 +3168,21 @@ interface(`init_admin',`
 	init_stop_system($1)
 	init_telinit($1)
 ')
+
+########################################
+## <summary>
+##      Allow getting init_t rlimit
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Source domain
+##      </summary>
+## </param>
+#
+interface(`init_getrlimit',`
+	gen_require(`
+		type init_t;
+	')
+
+	allow $1 init_t:process getrlimit;
+')
Index: refpolicy-2.20180701/policy/modules/system/init.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/system/init.te
+++ refpolicy-2.20180701/policy/modules/system/init.te
@@ -1,4 +1,4 @@
-policy_module(init, 2.5.0)
+policy_module(init, 2.5.8)
 
 gen_require(`
 	class passwd rootok;
@@ -191,6 +191,7 @@ mls_file_read_all_levels(init_t)
 mls_file_write_all_levels(init_t)
 mls_process_write_all_levels(init_t)
 mls_fd_use_all_levels(init_t)
+mls_process_set_level(init_t)
 
 # the following one is needed for libselinux:is_selinux_enabled()
 # otherwise the call fails and sysvinit tries to load the policy
@@ -384,6 +385,8 @@ ifdef(`init_systemd',`
 
 	# systemd_socket_activated policy
 	mls_socket_write_all_levels(init_t)
+	# read from systemd-journal and similar
+	mls_socket_read_to_clearance(init_t)
 
 	selinux_unmount_fs(init_t)
 	selinux_validate_context(init_t)
@@ -635,6 +638,7 @@ dev_delete_generic_symlinks(initrc_t)
 dev_getattr_all_blk_files(initrc_t)
 dev_getattr_all_chr_files(initrc_t)
 dev_rw_xserver_misc(initrc_t)
+dev_map_xserver_misc(initrc_t)
 
 domain_kill_all_domains(initrc_t)
 domain_signal_all_domains(initrc_t)
@@ -1368,7 +1372,7 @@ ifdef(`init_systemd',`
 	fs_search_cgroup_dirs(daemon)
 
 	# need write to /var/run/systemd/notify
-	init_write_pid_socket(daemon)
+	init_write_runtime_socket(daemon)
 ')
 
 tunable_policy(`init_daemons_use_tty',`
Index: refpolicy-2.20180701/policy/modules/system/ipsec.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/system/ipsec.te
+++ refpolicy-2.20180701/policy/modules/system/ipsec.te
@@ -1,4 +1,4 @@
-policy_module(ipsec, 1.20.0)
+policy_module(ipsec, 1.20.1)
 
 ########################################
 #
@@ -151,12 +151,16 @@ corenet_udp_bind_isakmp_port(ipsec_t)
 corenet_udp_bind_ipsecnat_port(ipsec_t)
 corenet_sendrecv_generic_server_packets(ipsec_t)
 corenet_sendrecv_isakmp_server_packets(ipsec_t)
+# allow pluto to build Security Association Database
+corenet_setcontext_all_spds(ipsec_t)
 
 dev_read_sysfs(ipsec_t)
 dev_read_rand(ipsec_t)
 dev_read_urand(ipsec_t)
 
 domain_use_interactive_fds(ipsec_t)
+# allow pluto to set contexts on ipsec policy and SAs
+domain_ipsec_setcontext_all_domains(ipsec_t)
 
 files_list_tmp(ipsec_t)
 files_read_etc_files(ipsec_t)
Index: refpolicy-2.20180701/policy/modules/system/iptables.fc
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/system/iptables.fc
+++ refpolicy-2.20180701/policy/modules/system/iptables.fc
@@ -20,7 +20,9 @@
 /usr/bin/ipvsadm-save			--	gen_context(system_u:object_r:iptables_exec_t,s0)
 /usr/bin/nft				--	gen_context(system_u:object_r:iptables_exec_t,s0)
 /usr/bin/xtables-compat-multi		--	gen_context(system_u:object_r:iptables_exec_t,s0)
+/usr/bin/xtables-legacy-multi		--	gen_context(system_u:object_r:iptables_exec_t,s0)
 /usr/bin/xtables-multi			--	gen_context(system_u:object_r:iptables_exec_t,s0)
+/usr/bin/xtables-nft-multi		--	gen_context(system_u:object_r:iptables_exec_t,s0)
 
 /usr/lib/systemd/system/[^/]*arptables.* --	gen_context(system_u:object_r:iptables_unit_t,s0)
 /usr/lib/systemd/system/[^/]*ebtables.*	 --	gen_context(system_u:object_r:iptables_unit_t,s0)
@@ -40,4 +42,6 @@
 /usr/sbin/ipvsadm-save			--	gen_context(system_u:object_r:iptables_exec_t,s0)
 /usr/sbin/nft				--	gen_context(system_u:object_r:iptables_exec_t,s0)
 /usr/sbin/xtables-compat-multi		--	gen_context(system_u:object_r:iptables_exec_t,s0)
+/usr/sbin/xtables-legacy-multi		--	gen_context(system_u:object_r:iptables_exec_t,s0)
 /usr/sbin/xtables-multi			--	gen_context(system_u:object_r:iptables_exec_t,s0)
+/usr/sbin/xtables-nft-multi		--	gen_context(system_u:object_r:iptables_exec_t,s0)
Index: refpolicy-2.20180701/policy/modules/system/iptables.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/system/iptables.te
+++ refpolicy-2.20180701/policy/modules/system/iptables.te
@@ -1,4 +1,4 @@
-policy_module(iptables, 1.20.0)
+policy_module(iptables, 1.20.3)
 
 ########################################
 #
Index: refpolicy-2.20180701/policy/modules/system/iscsi.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/system/iscsi.te
+++ refpolicy-2.20180701/policy/modules/system/iscsi.te
@@ -1,4 +1,4 @@
-policy_module(iscsi, 1.12.0)
+policy_module(iscsi, 1.12.1)
 
 ########################################
 #
@@ -40,6 +40,7 @@ allow iscsid_t self:fifo_file rw_fifo_fi
 allow iscsid_t self:unix_stream_socket { accept connectto listen };
 allow iscsid_t self:sem create_sem_perms;
 allow iscsid_t self:shm create_shm_perms;
+allow iscsid_t self:netlink_iscsi_socket create_socket_perms;
 allow iscsid_t self:netlink_socket create_socket_perms;
 allow iscsid_t self:netlink_kobject_uevent_socket create_socket_perms;
 allow iscsid_t self:netlink_route_socket nlmsg_write;
Index: refpolicy-2.20180701/policy/modules/system/logging.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/system/logging.te
+++ refpolicy-2.20180701/policy/modules/system/logging.te
@@ -1,4 +1,4 @@
-policy_module(logging, 1.28.0)
+policy_module(logging, 1.28.6)
 
 ########################################
 #
@@ -107,6 +107,8 @@ read_files_pattern(auditctl_t, auditd_et
 allow auditctl_t auditd_etc_t:dir list_dir_perms;
 dontaudit auditctl_t auditd_etc_t:file map;
 
+corecmd_search_bin(auditctl_t)
+
 # Needed for adding watches
 files_getattr_all_dirs(auditctl_t)
 files_getattr_all_files(auditctl_t)
@@ -539,14 +541,17 @@ ifdef(`init_systemd',`
 	dev_read_urand(syslogd_t)
 	dev_write_kmsg(syslogd_t)
 
+	domain_getattr_all_domains(syslogd_t)
 	domain_read_all_domains_state(syslogd_t)
 
-	init_create_pid_dirs(syslogd_t)
+	init_create_runtime_dirs(syslogd_t)
 	init_daemon_pid_file(syslogd_var_run_t, dir, "syslogd")
-	init_rename_pid_files(syslogd_t)
-	init_delete_pid_files(syslogd_t)
+	init_getattr(syslogd_t)
+	init_rename_runtime_files(syslogd_t)
+	init_delete_runtime_files(syslogd_t)
 	init_dgram_send(syslogd_t)
-	init_read_pid_pipes(syslogd_t)
+	init_read_runtime_pipes(syslogd_t)
+	init_read_runtime_symlinks(syslogd_t)
 	init_read_state(syslogd_t)
 
 	systemd_manage_journal_files(syslogd_t)
Index: refpolicy-2.20180701/policy/modules/system/miscfiles.fc
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/system/miscfiles.fc
+++ refpolicy-2.20180701/policy/modules/system/miscfiles.fc
@@ -48,9 +48,12 @@ ifdef(`distro_redhat',`
 /usr/local/share/fonts(/.*)?	gen_context(system_u:object_r:fonts_t,s0)
 
 /usr/share/docbook2X/xslt/man(/.*)?	gen_context(system_u:object_r:usr_t,s0)
+
 /usr/share/fonts(/.*)?		gen_context(system_u:object_r:fonts_t,s0)
-/usr/share/X11/fonts(/.*)?	gen_context(system_u:object_r:fonts_t,s0)
 /usr/share/ghostscript/fonts(/.*)? gen_context(system_u:object_r:fonts_t,s0)
+/usr/share/texmf[^/]*/fonts(/.*)? gen_context(system_u:object_r:fonts_t,s0)
+/usr/share/X11/fonts(/.*)?	gen_context(system_u:object_r:fonts_t,s0)
+
 /usr/share/locale(/.*)?		gen_context(system_u:object_r:locale_t,s0)
 /usr/share/X11/locale(/.*)?	gen_context(system_u:object_r:locale_t,s0)
 /usr/share/zoneinfo(/.*)?	gen_context(system_u:object_r:locale_t,s0)
Index: refpolicy-2.20180701/policy/modules/system/miscfiles.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/system/miscfiles.te
+++ refpolicy-2.20180701/policy/modules/system/miscfiles.te
@@ -1,4 +1,4 @@
-policy_module(miscfiles, 1.14.0)
+policy_module(miscfiles, 1.14.1)
 
 ########################################
 #
Index: refpolicy-2.20180701/policy/modules/system/modutils.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/system/modutils.te
+++ refpolicy-2.20180701/policy/modules/system/modutils.te
@@ -1,4 +1,4 @@
-policy_module(modutils, 1.20.0)
+policy_module(modutils, 1.20.2)
 
 ########################################
 #
@@ -58,6 +58,7 @@ can_exec(kmod_t, kmod_exec_t)
 
 kernel_load_module(kmod_t)
 kernel_request_load_module(kmod_t)
+kernel_read_crypto_sysctls(kmod_t)
 kernel_read_system_state(kmod_t)
 kernel_read_network_state(kmod_t)
 kernel_write_proc_files(kmod_t)
@@ -135,6 +136,7 @@ optional_policy(`
 	# for postinst of a new kernel package
 	dpkg_manage_script_tmp_files(kmod_t)
 	dpkg_map_script_tmp_files(kmod_t)
+	dpkg_read_script_tmp_symlinks(kmod_t)
 ')
 
 optional_policy(`
Index: refpolicy-2.20180701/policy/modules/system/selinuxutil.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/system/selinuxutil.te
+++ refpolicy-2.20180701/policy/modules/system/selinuxutil.te
@@ -1,4 +1,4 @@
-policy_module(selinuxutil, 1.24.0)
+policy_module(selinuxutil, 1.24.5)
 
 gen_require(`
 	bool secure_mode;
@@ -357,6 +357,7 @@ kernel_use_fds(restorecond_t)
 
 fs_dontaudit_list_nfs(restorecond_t)
 fs_getattr_all_xattr_fs(restorecond_t)
+fs_getattr_cgroup(restorecond_t)
 fs_getattr_pstore_dirs(restorecond_t)
 fs_getattr_tracefs(restorecond_t)
 fs_list_inotifyfs(restorecond_t)
@@ -371,6 +372,7 @@ selinux_compute_user_contexts(restorecon
 
 files_relabel_non_auth_files(restorecond_t )
 files_read_non_auth_files(restorecond_t)
+files_dontaudit_read_all_symlinks(restorecond_t)
 auth_use_nsswitch(restorecond_t)
 
 logging_send_syslog_msg(restorecond_t)
@@ -552,6 +554,13 @@ ifdef(`distro_ubuntu',`
 	')
 ')
 
+ifdef(`init_systemd',`
+	optional_policy(`
+		init_dbus_chat(semanage_t)
+		dbus_system_bus_client(semanage_t)
+	')
+')
+
 optional_policy(`
 	locallogin_use_fds(semanage_t)
 ')
@@ -599,6 +608,7 @@ files_read_usr_symlinks(setfiles_t)
 files_dontaudit_read_all_symlinks(setfiles_t)
 
 fs_getattr_all_xattr_fs(setfiles_t)
+fs_getattr_cgroup(setfiles_t)
 fs_getattr_nfs(setfiles_t)
 fs_getattr_pstore_dirs(setfiles_t)
 fs_getattr_pstorefs(setfiles_t)
Index: refpolicy-2.20180701/policy/modules/system/setrans.if
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/system/setrans.if
+++ refpolicy-2.20180701/policy/modules/system/setrans.if
@@ -21,7 +21,7 @@ interface(`setrans_initrc_domtrans',`
 
 #######################################
 ## <summary>
-##	Allow a domain to translate contexts.
+##	Allow a domain to translate contexts.  (Deprecated)
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -30,15 +30,7 @@ interface(`setrans_initrc_domtrans',`
 ## </param>
 #
 interface(`setrans_translate_context',`
-	gen_require(`
-		type setrans_t, setrans_var_run_t;
-		class context translate;
-	')
-
-	allow $1 self:unix_stream_socket create_stream_socket_perms;
-	allow $1 setrans_t:context translate;
-	stream_connect_pattern($1, setrans_var_run_t, setrans_var_run_t, setrans_t)
-	files_list_pids($1)
+	refpolicywarn(`$0($*) has been deprecated')
 ')
 
 ######################################
Index: refpolicy-2.20180701/policy/modules/system/setrans.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/system/setrans.te
+++ refpolicy-2.20180701/policy/modules/system/setrans.te
@@ -1,4 +1,4 @@
-policy_module(setrans, 1.14.0)
+policy_module(setrans, 1.14.1)
 
 gen_require(`
 	class context contains;
Index: refpolicy-2.20180701/policy/modules/system/sysnetwork.if
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/system/sysnetwork.if
+++ refpolicy-2.20180701/policy/modules/system/sysnetwork.if
@@ -753,12 +753,22 @@ interface(`sysnet_dns_name_resolve',`
 	')
 
 	optional_policy(`
-		nscd_use($1)
+	# for /etc/resolv.conf symlink
+		networkmanager_read_pid_files($1)
 	')
 
-	# This seems needed when the mymachines NSS module is used
 	optional_policy(`
-		systemd_read_machines($1)
+		nscd_use($1)
+	')
+
+	ifdef(`init_systemd',`
+		optional_policy(`
+			systemd_dbus_chat_resolved($1)
+		')
+		# This seems needed when the mymachines NSS module is used
+		optional_policy(`
+			systemd_read_machines($1)
+		')
 	')
 ')
 
Index: refpolicy-2.20180701/policy/modules/system/sysnetwork.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/system/sysnetwork.te
+++ refpolicy-2.20180701/policy/modules/system/sysnetwork.te
@@ -1,4 +1,4 @@
-policy_module(sysnetwork, 1.23.0)
+policy_module(sysnetwork, 1.23.3)
 
 ########################################
 #
@@ -68,6 +68,7 @@ exec_files_pattern(dhcpc_t, dhcp_etc_t,
 allow dhcpc_t dhcp_state_t:file read_file_perms;
 manage_files_pattern(dhcpc_t, dhcpc_state_t, dhcpc_state_t)
 filetrans_pattern(dhcpc_t, dhcp_state_t, dhcpc_state_t, file)
+allow dhcpc_t dhcpc_state_t:file map;
 
 # create pid file
 manage_files_pattern(dhcpc_t, dhcpc_var_run_t, dhcpc_var_run_t)
@@ -146,6 +147,8 @@ init_rw_utmp(dhcpc_t)
 logging_send_syslog_msg(dhcpc_t)
 
 miscfiles_read_localization(dhcpc_t)
+# dhclient reads /etc/ssl
+miscfiles_read_generic_certs(dhcpc_t)
 
 sysnet_run_ifconfig(dhcpc_t, dhcpc_roles)
 
Index: refpolicy-2.20180701/policy/modules/system/systemd.if
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/system/systemd.if
+++ refpolicy-2.20180701/policy/modules/system/systemd.if
@@ -270,6 +270,27 @@ interface(`systemd_read_machines',`
 
 ########################################
 ## <summary>
+##   Send and receive messages from
+##   systemd hostnamed over dbus.
+## </summary>
+## <param name="domain">
+##   <summary>
+##     Domain allowed access.
+##   </summary>
+## </param>
+#
+interface(`systemd_dbus_chat_hostnamed',`
+	gen_require(`
+		type systemd_hostnamed_t;
+		class dbus send_msg;
+	')
+
+	allow $1 systemd_hostnamed_t:dbus send_msg;
+	allow systemd_hostnamed_t $1:dbus send_msg;
+')
+
+########################################
+## <summary>
 ##      allow systemd_passwd_agent to inherit fds
 ## </summary>
 ## <param name="domain">
@@ -307,6 +328,7 @@ interface(`systemd_use_passwd_agent',`
 	manage_sock_files_pattern($1, systemd_passwd_var_run_t, systemd_passwd_var_run_t)
 
 	allow systemd_passwd_agent_t $1:process signull;
+	ps_process_pattern(systemd_passwd_agent_t, $1)
 	allow systemd_passwd_agent_t $1:unix_dgram_socket sendto;
 ')
 
@@ -369,6 +391,25 @@ interface(`systemd_manage_all_units',`
 
 ########################################
 ## <summary>
+##      Allow domain to read systemd_journal_t files
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+#
+interface(`systemd_read_journal_files',`
+	gen_require(`
+		type systemd_journal_t;
+	')
+
+	list_dirs_pattern($1, systemd_journal_t, systemd_journal_t)
+	mmap_read_files_pattern($1, systemd_journal_t, systemd_journal_t)
+')
+
+########################################
+## <summary>
 ##      Allow domain to create/manage systemd_journal_t files
 ## </summary>
 ## <param name="domain">
@@ -387,7 +428,6 @@ interface(`systemd_manage_journal_files'
 	allow $1 systemd_journal_t:file map;
 ')
 
-
 ########################################
 ## <summary>
 ##	Relabel to systemd-journald directory type.
@@ -469,6 +509,25 @@ interface(`systemd_manage_networkd_units
 
 ########################################
 ## <summary>
+##	Allow specified domain to enable systemd-networkd units
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`systemd_enabledisable_networkd',`
+	gen_require(`
+		type systemd_networkd_unit_t;
+		class service { enable disable };
+	')
+
+	allow $1 systemd_networkd_unit_t:service { enable disable };
+')
+
+########################################
+## <summary>
 ##	Allow specified domain to start systemd-networkd units
 ## </summary>
 ## <param name="domain">
@@ -543,6 +602,25 @@ interface(`systemd_rw_networkd_netlink_r
 
 #######################################
 ## <summary>
+##  Allow domain to list dirs under /run/systemd/netif
+## </summary>
+## <param name="domain">
+## <summary>
+##  domain permitted the access
+## </summary>
+## </param>
+#
+interface(`systemd_list_networkd_runtime',`
+	gen_require(`
+		type systemd_networkd_var_run_t;
+	')
+
+	init_list_pids($1)
+	allow $1 systemd_networkd_var_run_t:dir list_dir_perms;
+')
+
+#######################################
+## <summary>
 ##  Allow domain to read files generated by systemd_networkd
 ## </summary>
 ## <param name="domain">
@@ -753,6 +831,27 @@ interface(`systemd_tmpfilesd_managed',`
 	allow systemd_tmpfiles_t $1:$2 { setattr relabelfrom relabelto create };
 ')
 
+########################################
+## <summary>
+##   Send and receive messages from
+##   systemd resolved over dbus.
+## </summary>
+## <param name="domain">
+##   <summary>
+##     Domain allowed access.
+##   </summary>
+## </param>
+#
+interface(`systemd_dbus_chat_resolved',`
+	gen_require(`
+		type systemd_resolved_t;
+		class dbus send_msg;
+	')
+
+	allow $1 systemd_resolved_t:dbus send_msg;
+	allow systemd_resolved_t $1:dbus send_msg;
+')
+
 #######################################
 ## <summary>
 ##  Allow domain to read resolv.conf file generated by systemd_resolved
Index: refpolicy-2.20180701/policy/modules/system/systemd.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/system/systemd.te
+++ refpolicy-2.20180701/policy/modules/system/systemd.te
@@ -1,4 +1,4 @@
-policy_module(systemd, 1.6.0)
+policy_module(systemd, 1.6.9)
 
 #########################################
 #
@@ -136,6 +136,7 @@ init_daemon_domain(systemd_notify_t, sys
 type systemd_nspawn_t;
 type systemd_nspawn_exec_t;
 init_system_domain(systemd_nspawn_t, systemd_nspawn_exec_t)
+mcs_killall(systemd_nspawn_t)
 
 type systemd_nspawn_var_run_t;
 files_pid_file(systemd_nspawn_var_run_t)
@@ -165,6 +166,16 @@ init_system_domain(systemd_passwd_agent_
 type systemd_passwd_var_run_t;
 files_pid_file(systemd_passwd_var_run_t)
 
+type systemd_rfkill_t;
+type systemd_rfkill_exec_t;
+init_daemon_domain(systemd_rfkill_t, systemd_rfkill_exec_t)
+
+type systemd_rfkill_unit_t;
+init_unit_file(systemd_rfkill_unit_t)
+
+type systemd_rfkill_var_lib_t;
+files_type(systemd_rfkill_var_lib_t)
+
 type systemd_sessions_t;
 type systemd_sessions_exec_t;
 init_system_domain(systemd_sessions_t, systemd_sessions_exec_t)
@@ -236,6 +247,7 @@ fs_register_binary_executable_type(syste
 #
 
 dev_read_sysfs(systemd_gpt_generator_t)
+files_list_usr(systemd_gpt_generator_t)
 files_read_etc_files(systemd_gpt_generator_t)
 fs_getattr_xattr_fs(systemd_gpt_generator_t)
 storage_raw_read_fixed_disk(systemd_gpt_generator_t)
@@ -254,6 +266,8 @@ kernel_dgram_send(systemd_cgroups_t)
 # for /proc/cmdline
 kernel_read_system_state(systemd_cgroups_t)
 
+mls_fd_use_all_levels(systemd_cgroups_t)
+
 selinux_getattr_fs(systemd_cgroups_t)
 
 # write to /run/systemd/cgroups-agent
@@ -266,6 +280,10 @@ seutil_libselinux_linked(systemd_cgroups
 
 systemd_log_parse_environment(systemd_cgroups_t)
 
+ifdef(`enable_mls',`
+	kernel_ranged_domtrans_to(systemd_cgroups_t, systemd_cgroups_exec_t, s0 - mls_systemhigh)
+')
+
 ######################################
 #
 # coredump local policy
@@ -297,7 +315,7 @@ selinux_getattr_fs(systemd_coredump_t)
 init_list_var_lib_dirs(systemd_coredump_t)
 init_read_state(systemd_coredump_t)
 init_search_pids(systemd_coredump_t)
-init_write_pid_socket(systemd_coredump_t)
+init_write_runtime_socket(systemd_coredump_t)
 
 logging_send_syslog_msg(systemd_coredump_t)
 
@@ -317,6 +335,9 @@ files_read_etc_files(systemd_hostnamed_t
 
 seutil_read_file_contexts(systemd_hostnamed_t)
 
+sysnet_etc_filetrans_config(systemd_hostnamed_t)
+sysnet_manage_config(systemd_hostnamed_t)
+
 systemd_log_parse_environment(systemd_hostnamed_t)
 
 optional_policy(`
@@ -387,7 +408,7 @@ logging_send_syslog_msg(systemd_log_pars
 # Logind local policy
 #
 
-allow systemd_logind_t self:capability { chown dac_override fowner sys_admin sys_tty_config };
+allow systemd_logind_t self:capability { chown dac_override dac_read_search fowner sys_admin sys_tty_config };
 allow systemd_logind_t self:process { getcap setfscreate };
 allow systemd_logind_t self:netlink_kobject_uevent_socket create_socket_perms;
 allow systemd_logind_t self:unix_dgram_socket create_socket_perms;
@@ -423,6 +444,7 @@ dev_rw_input_dev(systemd_logind_t)
 dev_rw_sysfs(systemd_logind_t)
 dev_setattr_dri_dev(systemd_logind_t)
 dev_setattr_generic_usb_dev(systemd_logind_t)
+dev_setattr_input_dev(systemd_logind_t)
 dev_setattr_kvm_dev(systemd_logind_t)
 dev_setattr_sound_dev(systemd_logind_t)
 dev_setattr_video_dev(systemd_logind_t)
@@ -457,6 +479,7 @@ auth_manage_faillog(systemd_logind_t)
 init_dbus_send_script(systemd_logind_t)
 init_get_all_units_status(systemd_logind_t)
 init_get_system_status(systemd_logind_t)
+init_read_utmp(systemd_logind_t)
 init_service_start(systemd_logind_t)
 init_service_status(systemd_logind_t)
 init_start_all_units(systemd_logind_t)
@@ -671,10 +694,11 @@ miscfiles_read_localization(systemd_noti
 # Nspawn local policy
 #
 
-allow systemd_nspawn_t self:process { getcap setcap setfscreate sigkill };
-allow systemd_nspawn_t self:capability { dac_override fsetid mknod net_admin setgid setuid setpcap sys_admin sys_chroot };
+allow systemd_nspawn_t self:process { signal getcap setcap setfscreate setrlimit sigkill };
+allow systemd_nspawn_t self:capability { dac_override dac_read_search fsetid mknod net_admin setgid setuid setpcap sys_admin sys_chroot };
 allow systemd_nspawn_t self:capability2 wake_alarm;
 allow systemd_nspawn_t self:unix_dgram_socket connected_socket_perms;
+allow systemd_nspawn_t self:unix_stream_socket create_stream_socket_perms;
 
 allow systemd_nspawn_t systemd_journal_t:dir search;
 
@@ -684,9 +708,11 @@ allow systemd_nspawn_t systemd_nspawn_va
 allow systemd_nspawn_t systemd_nspawn_var_run_t:file manage_file_perms;
 init_pid_filetrans(systemd_nspawn_t, systemd_nspawn_var_run_t, dir)
 
-files_tmp_filetrans(systemd_nspawn_t, systemd_nspawn_tmp_t, { dir })
+files_tmp_filetrans(systemd_nspawn_t, systemd_nspawn_tmp_t, { dir file })
 allow systemd_nspawn_t systemd_nspawn_tmp_t:dir manage_dir_perms;
 allow systemd_nspawn_t systemd_nspawn_tmp_t:dir mounton;
+# for /tmp/.#inaccessible*
+allow systemd_nspawn_t systemd_nspawn_tmp_t:file manage_file_perms;
 
 # for /run/systemd/nspawn/incoming in chroot
 allow systemd_nspawn_t systemd_nspawn_var_run_t:dir mounton;
@@ -720,6 +746,7 @@ files_manage_mnt_dirs(systemd_nspawn_t)
 files_mounton_mnt(systemd_nspawn_t)
 files_mounton_root(systemd_nspawn_t)
 files_mounton_tmp(systemd_nspawn_t)
+files_read_kernel_symbol_table(systemd_nspawn_t)
 files_setattr_pid_dirs(systemd_nspawn_t)
 
 fs_getattr_tmpfs(systemd_nspawn_t)
@@ -736,10 +763,11 @@ term_setattr_generic_ptys(systemd_nspawn
 term_use_ptmx(systemd_nspawn_t)
 
 init_domtrans_script(systemd_nspawn_t)
+init_getrlimit(systemd_nspawn_t)
 init_kill_scripts(systemd_nspawn_t)
 init_read_state(systemd_nspawn_t)
 init_search_run(systemd_nspawn_t)
-init_write_pid_socket(systemd_nspawn_t)
+init_write_runtime_socket(systemd_nspawn_t)
 init_spec_domtrans_script(systemd_nspawn_t)
 
 miscfiles_manage_localization(systemd_nspawn_t)
@@ -750,6 +778,7 @@ sysnet_manage_config(systemd_nspawn_t)
 userdom_manage_user_home_dirs(systemd_nspawn_t)
 
 tunable_policy(`systemd_nspawn_labeled_namespace',`
+	corecmd_exec_bin(systemd_nspawn_t)
 	corecmd_exec_shell(systemd_nspawn_t)
 
 	dev_mounton(systemd_nspawn_t)
@@ -775,6 +804,7 @@ tunable_policy(`systemd_nspawn_labeled_n
 	fs_write_cgroup_files(systemd_nspawn_t)
 
 	selinux_getattr_fs(systemd_nspawn_t)
+	selinux_remount_fs(systemd_nspawn_t)
 	selinux_search_fs(systemd_nspawn_t)
 
 	init_domtrans(systemd_nspawn_t)
@@ -832,8 +862,8 @@ term_read_console(systemd_passwd_agent_t
 
 auth_use_nsswitch(systemd_passwd_agent_t)
 
-init_create_pid_dirs(systemd_passwd_agent_t)
-init_read_pid_pipes(systemd_passwd_agent_t)
+init_create_runtime_dirs(systemd_passwd_agent_t)
+init_read_runtime_pipes(systemd_passwd_agent_t)
 init_read_state(systemd_passwd_agent_t)
 init_read_utmp(systemd_passwd_agent_t)
 init_stream_connect(systemd_passwd_agent_t)
@@ -844,6 +874,7 @@ miscfiles_read_localization(systemd_pass
 
 seutil_search_default_contexts(systemd_passwd_agent_t)
 
+userdom_use_user_ttys(systemd_passwd_agent_t)
 userdom_use_user_ptys(systemd_passwd_agent_t)
 
 optional_policy(`
@@ -859,12 +890,32 @@ optional_policy(`
 ')
 
 
+#######################################
+#
+# Rfkill local policy
+#
+
+manage_dirs_pattern(systemd_rfkill_t, systemd_rfkill_var_lib_t, systemd_rfkill_var_lib_t)
+manage_files_pattern(systemd_rfkill_t, systemd_rfkill_var_lib_t, systemd_rfkill_var_lib_t)
+init_var_lib_filetrans(systemd_rfkill_t, systemd_rfkill_var_lib_t, dir)
+
+dev_read_sysfs(systemd_rfkill_t)
+dev_rw_wireless(systemd_rfkill_t)
+
+# Allow reading /etc/udev/udev.conf
+files_read_etc_files(systemd_rfkill_t)
+
+# Allow reading /run/udev/data/+rfkill:rfkill0
+udev_read_pid_files(systemd_rfkill_t)
+
+systemd_log_parse_environment(systemd_rfkill_t)
+
 #########################################
 #
 # Resolved local policy
 #
 
-allow systemd_resolved_t self:capability { chown setgid setpcap setuid };
+allow systemd_resolved_t self:capability { chown net_raw setgid setpcap setuid };
 allow systemd_resolved_t self:process { getcap setcap setfscreate signal };
 
 allow systemd_resolved_t self:tcp_socket { accept listen };
@@ -881,8 +932,10 @@ kernel_read_kernel_sysctls(systemd_resol
 kernel_read_net_sysctls(systemd_resolved_t)
 
 corenet_tcp_bind_generic_node(systemd_resolved_t)
+corenet_tcp_bind_dns_port(systemd_resolved_t)
 corenet_tcp_bind_llmnr_port(systemd_resolved_t)
 corenet_udp_bind_generic_node(systemd_resolved_t)
+corenet_udp_bind_dns_port(systemd_resolved_t)
 corenet_udp_bind_llmnr_port(systemd_resolved_t)
 
 auth_use_nsswitch(systemd_resolved_t)
@@ -923,7 +976,7 @@ systemd_log_parse_environment(systemd_se
 # Tmpfiles local policy
 #
 
-allow systemd_tmpfiles_t self:capability { chown dac_override fowner fsetid mknod net_admin sys_admin };
+allow systemd_tmpfiles_t self:capability { chown dac_override dac_read_search fowner fsetid mknod net_admin sys_admin };
 allow systemd_tmpfiles_t self:process { setfscreate getcap };
 
 allow systemd_tmpfiles_t systemd_coredump_var_lib_t:dir { relabelfrom relabelto manage_dir_perms };
@@ -939,9 +992,11 @@ allow systemd_tmpfiles_t systemd_journal
 allow systemd_tmpfiles_t systemd_tmpfiles_conf_t:dir list_dir_perms;
 allow systemd_tmpfiles_t systemd_tmpfiles_conf_type:file read_file_perms;
 
+kernel_getattr_proc(systemd_tmpfiles_t)
 kernel_read_kernel_sysctls(systemd_tmpfiles_t)
 kernel_read_network_state(systemd_tmpfiles_t)
 
+dev_getattr_fs(systemd_tmpfiles_t)
 dev_manage_all_dev_nodes(systemd_tmpfiles_t)
 dev_read_urand(systemd_tmpfiles_t)
 dev_relabel_all_sysfs(systemd_tmpfiles_t)
@@ -957,6 +1012,7 @@ files_manage_var_dirs(systemd_tmpfiles_t
 files_manage_var_lib_dirs(systemd_tmpfiles_t)
 files_purge_tmp(systemd_tmpfiles_t)
 files_read_etc_files(systemd_tmpfiles_t)
+files_read_etc_runtime_files(systemd_tmpfiles_t)
 files_relabel_all_lock_dirs(systemd_tmpfiles_t)
 files_relabel_all_pid_dirs(systemd_tmpfiles_t)
 files_relabel_all_tmp_dirs(systemd_tmpfiles_t)
@@ -968,14 +1024,19 @@ files_relabelto_etc_dirs(systemd_tmpfile
 # for /etc/mtab
 files_manage_etc_symlinks(systemd_tmpfiles_t)
 
+fs_getattr_tmpfs(systemd_tmpfiles_t)
+fs_getattr_tmpfs_dirs(systemd_tmpfiles_t)
 fs_getattr_xattr_fs(systemd_tmpfiles_t)
 
 selinux_get_fs_mount(systemd_tmpfiles_t)
 selinux_search_fs(systemd_tmpfiles_t)
 
+auth_append_lastlog(systemd_tmpfiles_t)
 auth_manage_faillog(systemd_tmpfiles_t)
+auth_manage_lastlog(systemd_tmpfiles_t)
 auth_manage_login_records(systemd_tmpfiles_t)
 auth_manage_var_auth(systemd_tmpfiles_t)
+auth_relabel_lastlog(systemd_tmpfiles_t)
 auth_relabel_login_records(systemd_tmpfiles_t)
 auth_setattr_login_records(systemd_tmpfiles_t)
 
@@ -1020,6 +1081,7 @@ tunable_policy(`systemd_tmpfiles_manage_
 
 optional_policy(`
 	dbus_read_lib_files(systemd_tmpfiles_t)
+	dbus_relabel_lib_dirs(systemd_tmpfiles_t)
 ')
 
 optional_policy(`
Index: refpolicy-2.20180701/policy/modules/system/udev.if
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/system/udev.if
+++ refpolicy-2.20180701/policy/modules/system/udev.if
@@ -38,6 +38,37 @@ interface(`udev_domtrans',`
 
 ########################################
 ## <summary>
+##	Allow udev to execute the specified program in
+##	the specified domain.
+## </summary>
+## <desc>
+##	<p>
+##	This is a interface to support the UDEV 'RUN'
+##	command.  This will allow the command run by
+##	udev to be run in a domain other than udev_t.
+##	</p>
+## </desc>
+## <param name="domain">
+##	<summary>
+##	Domain to execute in.
+##	</summary>
+## </param>
+## <param name="entry_file">
+##	<summary>
+##	Domain entry point file.
+##	</summary>
+## </param>
+#
+interface(`udev_run_domain',`
+	gen_require(`
+		type udev_t;
+	')
+
+	domtrans_pattern(udev_t,$2,$1)
+')
+
+########################################
+## <summary>
 ##	Execute udev in the caller domain.
 ## </summary>
 ## <param name="domain">
Index: refpolicy-2.20180701/policy/modules/system/udev.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/system/udev.te
+++ refpolicy-2.20180701/policy/modules/system/udev.te
@@ -1,4 +1,4 @@
-policy_module(udev, 1.24.0)
+policy_module(udev, 1.24.2)
 
 ########################################
 #
@@ -306,10 +306,6 @@ optional_policy(`
 ')
 
 optional_policy(`
-	lvm_domtrans(udev_t)
-')
-
-optional_policy(`
 	fstools_domtrans(udev_t)
 ')
 
@@ -328,6 +324,10 @@ optional_policy(`
 ')
 
 optional_policy(`
+	iptables_domtrans(udev_t)
+')
+
+optional_policy(`
 	lvm_domtrans(udev_t)
 ')
 
Index: refpolicy-2.20180701/policy/modules/system/unconfined.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/system/unconfined.te
+++ refpolicy-2.20180701/policy/modules/system/unconfined.te
@@ -1,4 +1,4 @@
-policy_module(unconfined, 3.11.0)
+policy_module(unconfined, 3.11.2)
 
 ########################################
 #
@@ -58,6 +58,15 @@ ifdef(`direct_sysadm_daemon',`
         ')
 ')
 
+ifdef(`init_systemd',`
+	# for systemd-analyze
+	init_service_status(unconfined_t)
+
+	optional_policy(`
+		systemd_dbus_chat_resolved(unconfined_t)
+	')
+')
+
 optional_policy(`
 	ada_domtrans(unconfined_t)
 ')
Index: refpolicy-2.20180701/policy/support/misc_patterns.spt
===================================================================
--- refpolicy-2.20180701.orig/policy/support/misc_patterns.spt
+++ refpolicy-2.20180701/policy/support/misc_patterns.spt
@@ -7,7 +7,7 @@
 # 3. target domain
 #
 define(`domain_transition_pattern',`
-	allow $1 $2:file { getattr open read execute };
+	allow $1 $2:file mmap_exec_file_perms;
 	allow $1 $3:process transition;
 	dontaudit $1 $3:process { noatsecure siginh rlimitinh };
 ')
Index: refpolicy-2.20180701/policy/support/obj_perm_sets.spt
===================================================================
--- refpolicy-2.20180701.orig/policy/support/obj_perm_sets.spt
+++ refpolicy-2.20180701/policy/support/obj_perm_sets.spt
@@ -34,7 +34,7 @@ define(`devfile_class_set', `{ blk_file
 #
 # All socket classes.
 #
-define(`socket_class_set', `{ tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket appletalk_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_socket netlink_audit_socket netlink_ip6fw_socket netlink_dnrt_socket netlink_kobject_uevent_socket tun_socket netlink_iscsi_socket netlink_fib_lookup_socket netlink_connector_socket netlink_netfilter_socket netlink_generic_socket netlink_scsitransport_socket netlink_rdma_socket netlink_crypto_socket sctp_socket icmp_socket ax25_socket ipx_socket netrom_socket atmpvc_socket x25_socket rose_socket decnet_socket atmsvc_socket rds_socket irda_socket pppox_socket llc_socket can_socket tipc_socket bluetooth_socket iucv_socket rxrpc_socket isdn_socket phonet_socket ieee802154_socket caif_socket alg_socket nfc_socket vsock_socket kcm_socket qipcrtr_socket smc_socket }')
+define(`socket_class_set', `{ tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket appletalk_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_socket netlink_audit_socket netlink_ip6fw_socket netlink_dnrt_socket netlink_kobject_uevent_socket tun_socket netlink_iscsi_socket netlink_fib_lookup_socket netlink_connector_socket netlink_netfilter_socket netlink_generic_socket netlink_scsitransport_socket netlink_rdma_socket netlink_crypto_socket sctp_socket icmp_socket ax25_socket ipx_socket netrom_socket atmpvc_socket x25_socket rose_socket decnet_socket atmsvc_socket rds_socket irda_socket pppox_socket llc_socket can_socket tipc_socket bluetooth_socket iucv_socket rxrpc_socket isdn_socket phonet_socket ieee802154_socket caif_socket alg_socket nfc_socket vsock_socket kcm_socket qipcrtr_socket smc_socket xdp_socket }')
 
 #
 # Datagram socket classes.
@@ -154,7 +154,11 @@ define(`relabel_dir_perms',`{ getattr re
 define(`getattr_file_perms',`{ getattr }')
 define(`setattr_file_perms',`{ setattr }')
 define(`read_file_perms',`{ getattr open read lock ioctl }')
-define(`mmap_file_perms',`{ getattr open map read execute ioctl } refpolicywarn(`mmap_file_perms is deprecated, please use mmap_exec_file_perms instead')') # deprecated 20171213
+# deprecated 20171213
+define(`mmap_file_perms',`
+	{ getattr open map read execute ioctl }
+	refpolicywarn(`mmap_file_perms is deprecated, please use mmap_exec_file_perms instead')
+')
 define(`mmap_read_inherited_file_perms',`{ getattr map read ioctl }')
 define(`mmap_read_file_perms',`{ getattr open map read ioctl }')
 define(`mmap_exec_inherited_file_perms',`{ getattr map read execute ioctl }')
Index: refpolicy-2.20180701/policy/modules/admin/apt.fc
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/admin/apt.fc
+++ refpolicy-2.20180701/policy/modules/admin/apt.fc
@@ -1,9 +1,12 @@
 /etc/cron\.daily/apt	--	gen_context(system_u:object_r:apt_exec_t,s0)
 
-ifndef(`distro_redhat',`
+/usr/bin/apt		--	gen_context(system_u:object_r:apt_exec_t,s0)
 /usr/bin/apt-get	--	gen_context(system_u:object_r:apt_exec_t,s0)
 /usr/bin/apt-shell	--	gen_context(system_u:object_r:apt_exec_t,s0)
 /usr/bin/aptitude	--	gen_context(system_u:object_r:apt_exec_t,s0)
+/usr/sbin/update-apt-xapian-index -- gen_context(system_u:object_r:apt_exec_t,s0)
+
+ifndef(`distro_redhat',`
 /usr/sbin/synaptic	--	gen_context(system_u:object_r:apt_exec_t,s0)
 /usr/lib/packagekit/packagekitd	--	gen_context(system_u:object_r:apt_exec_t,s0)
 /var/cache/PackageKit(/.*)?	gen_context(system_u:object_r:apt_var_cache_t,s0)
Index: refpolicy-2.20180701/policy/modules/admin/apt.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/admin/apt.te
+++ refpolicy-2.20180701/policy/modules/admin/apt.te
@@ -1,4 +1,4 @@
-policy_module(apt, 1.12.0)
+policy_module(apt, 1.12.2)
 
 ########################################
 #
Index: refpolicy-2.20180701/policy/modules/admin/backup.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/admin/backup.te
+++ refpolicy-2.20180701/policy/modules/admin/backup.te
@@ -1,4 +1,4 @@
-policy_module(backup, 1.8.0)
+policy_module(backup, 1.8.1)
 
 ########################################
 #
@@ -65,6 +65,8 @@ auth_read_shadow(backup_t)
 
 logging_send_syslog_msg(backup_t)
 
+miscfiles_read_localization(backup_t)
+
 sysnet_read_config(backup_t)
 
 userdom_use_user_terminals(backup_t)
Index: refpolicy-2.20180701/policy/modules/admin/bootloader.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/admin/bootloader.te
+++ refpolicy-2.20180701/policy/modules/admin/bootloader.te
@@ -1,4 +1,4 @@
-policy_module(bootloader, 1.18.0)
+policy_module(bootloader, 1.18.2)
 
 ########################################
 #
@@ -95,6 +95,7 @@ mls_file_read_all_levels(bootloader_t)
 mls_file_write_all_levels(bootloader_t)
 
 term_getattr_all_ttys(bootloader_t)
+term_getattr_generic_ptys(bootloader_t)
 term_dontaudit_manage_pty_dirs(bootloader_t)
 
 corecmd_exec_all_executables(bootloader_t)
@@ -102,6 +103,7 @@ corecmd_exec_all_executables(bootloader_
 domain_use_interactive_fds(bootloader_t)
 
 files_create_boot_dirs(bootloader_t)
+files_getattr_default_dirs(bootloader_t)
 files_manage_boot_files(bootloader_t)
 files_manage_boot_symlinks(bootloader_t)
 files_read_etc_files(bootloader_t)
@@ -118,6 +120,7 @@ files_manage_etc_runtime_files(bootloade
 files_etc_filetrans_etc_runtime(bootloader_t, file)
 files_dontaudit_search_home(bootloader_t)
 
+fs_list_hugetlbfs(bootloader_t)
 fs_mount_fusefs(bootloader_t)
 fs_mount_xattr_fs(bootloader_t)
 fs_mounton_fusefs(bootloader_t)
@@ -144,7 +147,9 @@ miscfiles_read_localization(bootloader_t
 
 mount_rw_runtime_files(bootloader_t)
 
+selinux_getattr_fs(bootloader_t)
 seutil_read_bin_policy(bootloader_t)
+seutil_read_file_contexts(bootloader_t)
 seutil_read_loadpolicy(bootloader_t)
 seutil_dontaudit_search_config(bootloader_t)
 
@@ -172,7 +177,7 @@ ifdef(`distro_debian',`
 
 	# for apt-cache
 	apt_read_db(bootloader_t)
-	apt_read_cache(bootloader_t)
+	apt_manage_cache(bootloader_t)
 
 	dpkg_read_db(bootloader_t)
 	dpkg_rw_pipes(bootloader_t)
@@ -204,6 +209,10 @@ optional_policy(`
 ')
 
 optional_policy(`
+	gpm_getattr_gpmctl(bootloader_t)
+')
+
+optional_policy(`
 	hal_dontaudit_append_lib_files(bootloader_t)
 	hal_write_log(bootloader_t)
 ')
@@ -230,5 +239,9 @@ optional_policy(`
 ')
 
 optional_policy(`
+	raid_read_mdadm_pid(bootloader_t)
+')
+
+optional_policy(`
 	rpm_rw_pipes(bootloader_t)
 ')
Index: refpolicy-2.20180701/policy/modules/admin/dpkg.if
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/admin/dpkg.if
+++ refpolicy-2.20180701/policy/modules/admin/dpkg.if
@@ -319,3 +319,21 @@ interface(`dpkg_map_script_tmp_files',`
 
 	allow $1 dpkg_script_tmp_t:file map;
 ')
+
+########################################
+## <summary>
+##	read dpkg_script_tmp_t links
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`dpkg_read_script_tmp_symlinks',`
+	gen_require(`
+		type dpkg_script_tmp_t;
+	')
+
+	allow $1 dpkg_script_tmp_t:lnk_file read_lnk_file_perms;
+')
Index: refpolicy-2.20180701/policy/modules/admin/dpkg.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/admin/dpkg.te
+++ refpolicy-2.20180701/policy/modules/admin/dpkg.te
@@ -1,4 +1,4 @@
-policy_module(dpkg, 1.13.0)
+policy_module(dpkg, 1.13.1)
 
 ########################################
 #
@@ -317,6 +317,10 @@ optional_policy(`
 ')
 
 optional_policy(`
+	init_dbus_chat(dpkg_script_t)
+')
+
+optional_policy(`
 	modutils_run(dpkg_script_t, dpkg_roles)
 ')
 
Index: refpolicy-2.20180701/policy/modules/admin/rpm.fc
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/admin/rpm.fc
+++ refpolicy-2.20180701/policy/modules/admin/rpm.fc
@@ -38,9 +38,6 @@
 /usr/sbin/packagekitd	--	gen_context(system_u:object_r:rpm_exec_t,s0)
 
 ifdef(`distro_redhat',`
-/usr/bin/apt-get	--	gen_context(system_u:object_r:rpm_exec_t,s0)
-/usr/bin/apt-shell	--	gen_context(system_u:object_r:rpm_exec_t,s0)
-/usr/bin/aptitude	--	gen_context(system_u:object_r:rpm_exec_t,s0)
 /usr/sbin/synaptic	--	gen_context(system_u:object_r:rpm_exec_t,s0)
 /var/cache/PackageKit(/.*)?	gen_context(system_u:object_r:rpm_var_cache_t,s0)
 /var/lib/PackageKit(/.*)?	gen_context(system_u:object_r:rpm_var_lib_t,s0)
Index: refpolicy-2.20180701/policy/modules/admin/rpm.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/admin/rpm.te
+++ refpolicy-2.20180701/policy/modules/admin/rpm.te
@@ -1,4 +1,4 @@
-policy_module(rpm, 1.22.0)
+policy_module(rpm, 1.22.1)
 
 ########################################
 #
Index: refpolicy-2.20180701/policy/modules/admin/sudo.if
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/admin/sudo.if
+++ refpolicy-2.20180701/policy/modules/admin/sudo.if
@@ -116,8 +116,8 @@ template(`sudo_role_template',`
 	auth_run_chk_passwd($1_sudo_t, $2)
 	# sudo stores a token in the pam_pid directory
 	auth_manage_pam_pid($1_sudo_t)
+	auth_use_pam($1_sudo_t)
 	auth_pid_filetrans_pam_var_run($1_sudo_t, dir, "sudo")
-	auth_use_nsswitch($1_sudo_t)
 
 	init_rw_utmp($1_sudo_t)
 
@@ -154,6 +154,10 @@ template(`sudo_role_template',`
 
 	optional_policy(`
 		dbus_system_bus_client($1_sudo_t)
+
+		ifdef(`init_systemd',`
+			init_dbus_chat($1_sudo_t)
+		')
 	')
 
 	optional_policy(`
Index: refpolicy-2.20180701/policy/modules/admin/sudo.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/admin/sudo.te
+++ refpolicy-2.20180701/policy/modules/admin/sudo.te
@@ -1,4 +1,4 @@
-policy_module(sudo, 1.12.0)
+policy_module(sudo, 1.12.2)
 
 ########################################
 #
Index: refpolicy-2.20180701/policy/modules/admin/usermanage.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/admin/usermanage.te
+++ refpolicy-2.20180701/policy/modules/admin/usermanage.te
@@ -1,4 +1,4 @@
-policy_module(usermanage, 1.21.0)
+policy_module(usermanage, 1.21.3)
 
 ########################################
 #
@@ -189,7 +189,7 @@ optional_policy(`
 #
 
 allow groupadd_t self:capability { audit_write chown dac_override fsetid kill setuid sys_resource };
-dontaudit groupadd_t self:capability { fsetid sys_tty_config };
+dontaudit groupadd_t self:capability { fsetid net_admin sys_tty_config };
 allow groupadd_t self:process { transition signal_perms getsched setsched getsession getpgid setpgid getcap setcap share getattr setfscreate noatsecure siginh setrlimit rlimitinh dyntransition setkeycreate setsockcreate getrlimit };
 allow groupadd_t self:fd use;
 allow groupadd_t self:fifo_file rw_fifo_file_perms;
@@ -252,6 +252,14 @@ userdom_use_unpriv_users_fds(groupadd_t)
 userdom_dontaudit_search_user_home_dirs(groupadd_t)
 
 optional_policy(`
+	apt_use_fds(groupadd_t)
+')
+
+optional_policy(`
+	dbus_system_bus_client(groupadd_t)
+')
+
+optional_policy(`
 	dpkg_use_fds(groupadd_t)
 	dpkg_rw_pipes(groupadd_t)
 ')
@@ -269,6 +277,10 @@ optional_policy(`
 	rpm_rw_pipes(groupadd_t)
 ')
 
+optional_policy(`
+	unconfined_use_fds(groupadd_t)
+')
+
 ########################################
 #
 # Passwd local policy
@@ -446,7 +458,7 @@ optional_policy(`
 #
 
 allow useradd_t self:capability { chown dac_override fowner fsetid kill setuid sys_resource };
-dontaudit useradd_t self:capability sys_tty_config;
+dontaudit useradd_t self:capability { net_admin sys_tty_config };
 allow useradd_t self:process { transition signal_perms getsched setsched getsession getpgid setpgid getcap setcap share getattr setfscreate noatsecure siginh rlimitinh dyntransition setkeycreate setsockcreate getrlimit };
 allow useradd_t self:fd use;
 allow useradd_t self:fifo_file rw_fifo_file_perms;
@@ -538,6 +550,14 @@ optional_policy(`
 ')
 
 optional_policy(`
+	apt_use_fds(useradd_t)
+')
+
+optional_policy(`
+	dbus_system_bus_client(useradd_t)
+')
+
+optional_policy(`
 	dpkg_use_fds(useradd_t)
 	dpkg_rw_pipes(useradd_t)
 ')
@@ -560,3 +580,7 @@ optional_policy(`
 	rpm_use_fds(useradd_t)
 	rpm_rw_pipes(useradd_t)
 ')
+
+optional_policy(`
+	unconfined_use_fds(useradd_t)
+')
Index: refpolicy-2.20180701/policy/modules/apps/sigrok.fc
===================================================================
--- /dev/null
+++ refpolicy-2.20180701/policy/modules/apps/sigrok.fc
@@ -0,0 +1 @@
+/usr/bin/sigrok-cli	--	gen_context(system_u:object_r:sigrok_exec_t,s0)
Index: refpolicy-2.20180701/policy/modules/apps/sigrok.if
===================================================================
--- /dev/null
+++ refpolicy-2.20180701/policy/modules/apps/sigrok.if
@@ -0,0 +1,26 @@
+## <summary>sigrok signal analysis software suite.</summary>
+
+########################################
+## <summary>
+##	Execute sigrok in its domain.
+## </summary>
+## <param name="role">
+##	<summary>
+##	Role allowed access.
+##	</summary>
+## </param>
+## <param name="domain">
+##	<summary>
+##	User domain for the role.
+##	</summary>
+## </param>
+#
+interface(`sigrok_run',`
+	gen_require(`
+		type sigrok_t, sigrok_exec_t;
+		attribute_role sigrok_roles;
+	')
+
+	roleattribute $1 sigrok_roles;
+	domtrans_pattern($2, sigrok_exec_t, sigrok_t)
+')
Index: refpolicy-2.20180701/policy/modules/apps/sigrok.te
===================================================================
--- /dev/null
+++ refpolicy-2.20180701/policy/modules/apps/sigrok.te
@@ -0,0 +1,39 @@
+policy_module(sigrok, 1.0.0)
+  
+########################################
+#
+# Declarations
+#
+
+attribute_role sigrok_roles;
+roleattribute system_r sigrok_roles;
+
+type sigrok_t;
+type sigrok_exec_t;
+userdom_user_application_domain(sigrok_t, sigrok_exec_t)
+role sigrok_roles types sigrok_t;
+
+########################################
+#
+# Local policy
+#
+
+allow sigrok_t self:fifo_file rw_fifo_file_perms;
+allow sigrok_t self:netlink_kobject_uevent_socket create_socket_perms;
+allow sigrok_t self:tcp_socket create_socket_perms;
+
+corenet_tcp_connect_all_unreserved_ports(sigrok_t)
+
+dev_getattr_sysfs_dirs(sigrok_t)
+dev_read_sysfs(sigrok_t)
+dev_rw_generic_usb_dev(sigrok_t)
+
+files_read_etc_files(sigrok_t)
+
+term_use_unallocated_ttys(sigrok_t)
+
+userdom_use_user_ptys(sigrok_t)
+
+optional_policy(`
+	udev_read_pid_files(sigrok_t)
+')
Index: refpolicy-2.20180701/policy/modules/apps/syncthing.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/apps/syncthing.te
+++ refpolicy-2.20180701/policy/modules/apps/syncthing.te
@@ -1,4 +1,4 @@
-policy_module(syncthing, 1.1.0)
+policy_module(syncthing, 1.1.2)
 
 ########################################
 #
@@ -21,11 +21,12 @@ xdg_config_content(syncthing_xdg_config_
 # Declarations
 #
 
-allow syncthing_t self:process getsched;
+allow syncthing_t self:process { signal_perms setpgid setsched getsched };
 allow syncthing_t self:fifo_file rw_fifo_file_perms;
 allow syncthing_t self:tcp_socket { listen accept };
 
 can_exec(syncthing_t, syncthing_exec_t)
+corecmd_exec_bin(syncthing_t)
 
 manage_dirs_pattern(syncthing_t, syncthing_xdg_config_t, syncthing_xdg_config_t)
 manage_files_pattern(syncthing_t, syncthing_xdg_config_t, syncthing_xdg_config_t)
@@ -35,6 +36,7 @@ xdg_config_filetrans(syncthing_t, syncth
 kernel_read_kernel_sysctls(syncthing_t)
 kernel_read_net_sysctls(syncthing_t)
 kernel_read_system_state(syncthing_t)
+kernel_read_network_state(syncthing_t)
 
 corenet_tcp_sendrecv_generic_if(syncthing_t)
 corenet_udp_sendrecv_generic_if(syncthing_t)
@@ -63,7 +65,3 @@ userdom_user_content_access_template(syn
 
 userdom_use_user_terminals(syncthing_t)
 
-optional_policy(`
-	# temporary hack for /run/NetworkManager/resolv.conf until we make this part of sysnet_dns_name_resolve()
-	networkmanager_read_pid_files(syncthing_t)
-')
Index: refpolicy-2.20180701/policy/modules/roles/unprivuser.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/roles/unprivuser.te
+++ refpolicy-2.20180701/policy/modules/roles/unprivuser.te
@@ -150,6 +150,10 @@ ifndef(`distro_redhat',`
 	')
 
 	optional_policy(`
+		sigrok_run(user_r, user_t)
+	')
+
+	optional_policy(`
 		spamassassin_role(user_r, user_t)
 	')
 
Index: refpolicy-2.20180701/policy/modules/services/boinc.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/services/boinc.te
+++ refpolicy-2.20180701/policy/modules/services/boinc.te
@@ -1,4 +1,4 @@
-policy_module(boinc, 1.5.0)
+policy_module(boinc, 1.5.1)
 
 ########################################
 #
@@ -47,7 +47,7 @@ files_tmp_file(boinc_project_tmp_t)
 # Local policy
 #
 
-allow boinc_t self:process { setsched setpgid signull sigkill };
+allow boinc_t self:process { setsched setpgid signull sigkill signal };
 allow boinc_t self:unix_stream_socket { accept listen };
 allow boinc_t self:tcp_socket { accept listen };
 allow boinc_t self:shm create_shm_perms;
@@ -80,12 +80,15 @@ logging_log_filetrans(boinc_t, boinc_log
 
 can_exec(boinc_t, boinc_var_lib_t)
 libs_exec_lib_files(boinc_t)
+# for mmap of ld.so.cache
+libs_legacy_use_ld_so(boinc_t)
 
 domtrans_pattern(boinc_t, boinc_project_var_lib_t, boinc_project_t)
 
 kernel_read_system_state(boinc_t)
 kernel_search_vm_sysctl(boinc_t)
 kernel_read_crypto_sysctls(boinc_t)
+kernel_read_kernel_sysctls(boinc_t)
 
 corenet_all_recvfrom_unlabeled(boinc_t)
 corenet_all_recvfrom_netlabel(boinc_t)
@@ -142,6 +145,7 @@ init_read_utmp(boinc_t)
 logging_send_syslog_msg(boinc_t)
 
 miscfiles_read_fonts(boinc_t)
+miscfiles_read_generic_certs(boinc_t)
 miscfiles_read_localization(boinc_t)
 
 tunable_policy(`boinc_execmem',`
@@ -210,5 +214,18 @@ term_getattr_generic_ptys(boinc_t)
 userdom_getattr_user_ttys(boinc_t)
 
 optional_policy(`
+	# for lsb_release -a
+	apt_read_cache(boinc_t)
+	apt_read_db(boinc_t)
+	dpkg_exec(boinc_t)
+	dpkg_read_db(boinc_t)
+
+	apt_read_cache(boinc_project_t)
+	apt_read_db(boinc_project_t)
+	dpkg_exec(boinc_project_t)
+	dpkg_read_db(boinc_project_t)
+')
+
+optional_policy(`
 	java_exec(boinc_project_t)
 ')
Index: refpolicy-2.20180701/policy/modules/services/consolekit.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/services/consolekit.te
+++ refpolicy-2.20180701/policy/modules/services/consolekit.te
@@ -1,4 +1,4 @@
-policy_module(consolekit, 1.13.0)
+policy_module(consolekit, 1.13.1)
 
 ########################################
 #
@@ -27,7 +27,7 @@ init_daemon_pid_file(consolekit_var_run_
 # Local policy
 #
 
-allow consolekit_t self:capability { chown dac_override fowner setgid setuid sys_admin sys_nice sys_ptrace sys_tty_config };
+allow consolekit_t self:capability { chown dac_override dac_read_search fowner setgid setuid sys_admin sys_nice sys_ptrace sys_tty_config };
 allow consolekit_t self:process { getsched signal setfscreate };
 allow consolekit_t self:fifo_file rw_fifo_file_perms;
 allow consolekit_t self:unix_stream_socket { accept listen };
Index: refpolicy-2.20180701/policy/modules/services/dbus.if
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/services/dbus.if
+++ refpolicy-2.20180701/policy/modules/services/dbus.if
@@ -19,6 +19,25 @@ interface(`dbus_stub',`
 
 ########################################
 ## <summary>
+##	Execute dbus in the caller domain.
+## </summary>
+## <param name="domain">
+## <summary>
+##	Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`dbus_exec',`
+	gen_require(`
+		type dbusd_exec_t;
+	')
+
+	corecmd_search_bin($1)
+	can_exec($1, dbusd_exec_t)
+')
+
+########################################
+## <summary>
 ##	Role access for dbus.
 ## </summary>
 ## <param name="role_prefix">
@@ -317,6 +336,25 @@ interface(`dbus_read_lib_files',`
 ')
 
 ########################################
+## <summary>
+##	Relabel system dbus lib directory.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`dbus_relabel_lib_dirs',`
+	gen_require(`
+		type system_dbusd_var_lib_t;
+	')
+
+	files_search_var_lib($1)
+	allow $1 system_dbusd_var_lib_t:dir { relabelfrom relabelto };
+')
+
+########################################
 ## <summary>
 ##	Create, read, write, and delete
 ##	system dbus lib files.
Index: refpolicy-2.20180701/policy/modules/services/devicekit.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/services/devicekit.te
+++ refpolicy-2.20180701/policy/modules/services/devicekit.te
@@ -1,4 +1,4 @@
-policy_module(devicekit, 1.9.0)
+policy_module(devicekit, 1.9.2)
 
 ########################################
 #
@@ -43,6 +43,7 @@ files_pid_filetrans(devicekit_t, devicek
 kernel_read_system_state(devicekit_t)
 
 dev_read_sysfs(devicekit_t)
+dev_read_rand(devicekit_t)
 dev_read_urand(devicekit_t)
 
 files_read_etc_files(devicekit_t)
@@ -176,6 +177,10 @@ optional_policy(`
 ')
 
 optional_policy(`
+	dmidecode_domtrans(devicekit_disk_t)
+')
+
+optional_policy(`
 	fstools_domtrans(devicekit_disk_t)
 ')
 
Index: refpolicy-2.20180701/policy/modules/services/dictd.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/services/dictd.te
+++ refpolicy-2.20180701/policy/modules/services/dictd.te
@@ -1,4 +1,4 @@
-policy_module(dictd, 1.12.0)
+policy_module(dictd, 1.12.1)
 
 ########################################
 #
@@ -74,6 +74,10 @@ miscfiles_read_localization(dictd_t)
 userdom_dontaudit_use_unpriv_user_fds(dictd_t)
 
 optional_policy(`
+	dbus_system_bus_client(dictd_t)
+')
+
+optional_policy(`
 	seutil_sigchld_newrole(dictd_t)
 ')
 
Index: refpolicy-2.20180701/policy/modules/services/fetchmail.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/services/fetchmail.te
+++ refpolicy-2.20180701/policy/modules/services/fetchmail.te
@@ -1,4 +1,4 @@
-policy_module(fetchmail, 1.17.0)
+policy_module(fetchmail, 1.17.1)
 
 ########################################
 #
@@ -78,6 +78,7 @@ dev_read_rand(fetchmail_t)
 dev_read_urand(fetchmail_t)
 
 files_read_etc_runtime_files(fetchmail_t)
+files_read_usr_files(fetchmail_t)
 files_search_tmp(fetchmail_t)
 files_dontaudit_search_home(fetchmail_t)
 
Index: refpolicy-2.20180701/policy/modules/services/gdomap.fc
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/services/gdomap.fc
+++ refpolicy-2.20180701/policy/modules/services/gdomap.fc
@@ -5,3 +5,4 @@
 /usr/bin/gdomap	--	gen_context(system_u:object_r:gdomap_exec_t,s0)
 
 /run/gdomap\.pid	--	gen_context(system_u:object_r:gdomap_var_run_t,s0)
+/run/gdomap(/.*)?		gen_context(system_u:object_r:gdomap_var_run_t,s0)
Index: refpolicy-2.20180701/policy/modules/services/gdomap.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/services/gdomap.te
+++ refpolicy-2.20180701/policy/modules/services/gdomap.te
@@ -1,4 +1,4 @@
-policy_module(gdomap, 1.3.0)
+policy_module(gdomap, 1.3.1)
 
 ########################################
 #
@@ -27,6 +27,8 @@ allow gdomap_t self:capability { net_bin
 allow gdomap_t self:tcp_socket { listen accept };
 
 allow gdomap_t gdomap_var_run_t:file manage_file_perms;
+# gdomap_var_run_t dir is for chroot
+allow gdomap_t gdomap_var_run_t:dir search;
 files_pid_filetrans(gdomap_t, gdomap_var_run_t, file, "gdomap.pid")
 
 corenet_sendrecv_gdomap_server_packets(gdomap_t)
@@ -44,3 +46,5 @@ files_search_tmp(gdomap_t)
 auth_use_nsswitch(gdomap_t)
 
 logging_send_syslog_msg(gdomap_t)
+
+miscfiles_read_localization(gdomap_t)
Index: refpolicy-2.20180701/policy/modules/services/gpm.if
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/services/gpm.if
+++ refpolicy-2.20180701/policy/modules/services/gpm.if
@@ -59,6 +59,7 @@ interface(`gpm_dontaudit_getattr_gpmctl'
 	')
 
 	dontaudit $1 gpmctl_t:sock_file getattr_sock_file_perms;
+	dontaudit $1 gpmctl_t:fifo_file getattr_fifo_file_perms;
 ')
 
 ########################################
Index: refpolicy-2.20180701/policy/modules/services/gpm.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/services/gpm.te
+++ refpolicy-2.20180701/policy/modules/services/gpm.te
@@ -1,4 +1,4 @@
-policy_module(gpm, 1.12.0)
+policy_module(gpm, 1.12.1)
 
 ########################################
 #
Index: refpolicy-2.20180701/policy/modules/services/jabber.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/services/jabber.te
+++ refpolicy-2.20180701/policy/modules/services/jabber.te
@@ -1,4 +1,4 @@
-policy_module(jabber, 1.13.0)
+policy_module(jabber, 1.13.2)
 
 ########################################
 #
@@ -38,6 +38,7 @@ allow jabberd_domain self:fifo_file rw_f
 allow jabberd_domain self:tcp_socket { accept listen };
 
 manage_files_pattern(jabberd_domain, jabberd_var_lib_t, jabberd_var_lib_t)
+allow jabberd_domain jabberd_var_lib_t:dir manage_dir_perms;
 
 kernel_read_system_state(jabberd_domain)
 
@@ -46,6 +47,7 @@ corenet_all_recvfrom_netlabel(jabberd_do
 corenet_tcp_sendrecv_generic_if(jabberd_domain)
 corenet_tcp_sendrecv_generic_node(jabberd_domain)
 corenet_tcp_bind_generic_node(jabberd_domain)
+corenet_udp_bind_generic_node(jabberd_domain)
 
 dev_read_urand(jabberd_domain)
 dev_read_sysfs(jabberd_domain)
@@ -78,9 +80,8 @@ allow jabberd_t self:netlink_route_socke
 manage_files_pattern(jabberd_t, jabberd_lock_t, jabberd_lock_t)
 
 allow jabberd_t jabberd_log_t:dir setattr_dir_perms;
-append_files_pattern(jabberd_t, jabberd_log_t, jabberd_log_t)
-create_files_pattern(jabberd_t, jabberd_log_t, jabberd_log_t)
-setattr_files_pattern(jabberd_t, jabberd_log_t, jabberd_log_t)
+manage_files_pattern(jabberd_t, jabberd_log_t, jabberd_log_t)
+
 logging_log_filetrans(jabberd_t, jabberd_log_t, { file dir })
 
 manage_files_pattern(jabberd_domain, jabberd_spool_t, jabberd_spool_t)
Index: refpolicy-2.20180701/policy/modules/services/mon.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/services/mon.te
+++ refpolicy-2.20180701/policy/modules/services/mon.te
@@ -1,4 +1,4 @@
-policy_module(mon, 1.2.0)
+policy_module(mon, 1.2.1)
 
 ########################################
 #
@@ -161,6 +161,7 @@ optional_policy(`
 
 allow mon_local_test_t self:capability sys_admin;
 allow mon_local_test_t self:fifo_file rw_file_perms;
+allow mon_local_test_t self:process getsched;
 
 can_exec(mon_local_test_t, mon_local_test_exec_t)
 
@@ -168,6 +169,8 @@ manage_files_pattern(mon_local_test_t, m
 
 kernel_dontaudit_getattr_core_if(mon_local_test_t)
 kernel_getattr_proc(mon_local_test_t)
+# for ps
+kernel_read_kernel_sysctls(mon_local_test_t)
 kernel_read_software_raid_state(mon_local_test_t)
 kernel_read_system_state(mon_local_test_t)
 
@@ -207,6 +210,7 @@ init_getattr_initctl(mon_local_test_t)
 
 logging_send_syslog_msg(mon_local_test_t)
 
+miscfiles_read_generic_certs(mon_t)
 miscfiles_read_localization(mon_local_test_t)
 
 sysnet_read_config(mon_local_test_t)
Index: refpolicy-2.20180701/policy/modules/services/networkmanager.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/services/networkmanager.te
+++ refpolicy-2.20180701/policy/modules/services/networkmanager.te
@@ -1,4 +1,4 @@
-policy_module(networkmanager, 1.23.0)
+policy_module(networkmanager, 1.23.2)
 
 ########################################
 #
@@ -57,6 +57,8 @@ allow NetworkManager_t self:tcp_socket {
 allow NetworkManager_t self:tun_socket { create_socket_perms relabelfrom relabelto };
 allow NetworkManager_t self:packet_socket create_socket_perms;
 allow NetworkManager_t self:socket create_socket_perms;
+# ICMPv6 router solicitation/advertisement
+allow NetworkManager_t self:rawip_socket { create setopt getattr write read };
 
 allow NetworkManager_t wpa_cli_t:unix_dgram_socket sendto;
 
@@ -137,6 +139,8 @@ dev_rw_wireless(NetworkManager_t)
 domain_use_interactive_fds(NetworkManager_t)
 domain_read_all_domains_state(NetworkManager_t)
 
+# /etc/resolv.conf is a symlink written by NM
+files_manage_etc_symlinks(NetworkManager_t)
 files_read_etc_runtime_files(NetworkManager_t)
 files_read_usr_files(NetworkManager_t)
 files_read_usr_src_files(NetworkManager_t)
@@ -345,6 +349,7 @@ optional_policy(`
 ')
 
 optional_policy(`
+	systemd_read_logind_pids(NetworkManager_t)
 	systemd_read_logind_sessions_files(NetworkManager_t)
 	systemd_write_inherited_logind_inhibit_pipes(NetworkManager_t)
 ')
Index: refpolicy-2.20180701/policy/modules/services/policykit.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/services/policykit.te
+++ refpolicy-2.20180701/policy/modules/services/policykit.te
@@ -1,4 +1,4 @@
-policy_module(policykit, 1.8.0)
+policy_module(policykit, 1.8.1)
 
 ########################################
 #
@@ -108,6 +108,7 @@ userdom_read_all_users_state(policykit_t
 
 optional_policy(`
 	dbus_system_domain(policykit_t, policykit_exec_t)
+	init_dbus_chat(policykit_t)
 
 	userdom_dbus_send_all_users(policykit_t)
 
Index: refpolicy-2.20180701/policy/modules/services/postfix.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/services/postfix.te
+++ refpolicy-2.20180701/policy/modules/services/postfix.te
@@ -1,4 +1,4 @@
-policy_module(postfix, 1.20.0)
+policy_module(postfix, 1.20.2)
 
 ########################################
 #
@@ -347,6 +347,12 @@ optional_policy(`
 ')
 
 optional_policy(`
+	dbus_send_system_bus(postfix_master_t)
+	dbus_system_bus_client(postfix_master_t)
+	init_dbus_chat(postfix_master_t)
+')
+
+optional_policy(`
 	sendmail_signal(postfix_master_t)
 ')
 
@@ -372,6 +378,14 @@ manage_dirs_pattern(postfix_bounce_t, po
 manage_files_pattern(postfix_bounce_t, postfix_spool_bounce_t, postfix_spool_bounce_t)
 manage_lnk_files_pattern(postfix_bounce_t, postfix_spool_bounce_t, postfix_spool_bounce_t)
 
+optional_policy(`
+	init_dbus_chat(postfix_bounce_t)
+')
+
+optional_policy(`
+	dbus_system_bus_client(postfix_bounce_t)
+')
+
 ########################################
 #
 # Cleanup local policy
@@ -416,6 +430,12 @@ optional_policy(`
 	mailman_read_data_files(postfix_cleanup_t)
 ')
 
+optional_policy(`
+	dbus_send_system_bus(postfix_cleanup_t)
+	dbus_system_bus_client(postfix_cleanup_t)
+	init_dbus_chat(postfix_cleanup_t)
+')
+
 ########################################
 #
 # Local local policy
@@ -557,6 +577,11 @@ delete_files_pattern(postfix_pickup_t, p
 mcs_file_read_all(postfix_pickup_t)
 mcs_file_write_all(postfix_pickup_t)
 
+optional_policy(`
+	dbus_system_bus_client(postfix_pickup_t)
+	init_dbus_chat(postfix_pickup_t)
+')
+
 ########################################
 #
 # Pipe local policy
@@ -704,6 +729,12 @@ files_spool_filetrans(postfix_qmgr_t, po
 
 corecmd_exec_bin(postfix_qmgr_t)
 
+optional_policy(`
+	dbus_send_system_bus(postfix_qmgr_t)
+	dbus_system_bus_client(postfix_qmgr_t)
+	init_dbus_chat(postfix_qmgr_t)
+')
+
 ########################################
 #
 # Showq local policy
@@ -782,6 +813,12 @@ mta_read_aliases(postfix_smtpd_t)
 mta_map_aliases(postfix_smtpd_t)
 
 optional_policy(`
+	dbus_send_system_bus(postfix_smtp_t)
+	dbus_system_bus_client(postfix_smtp_t)
+	init_dbus_chat(postfix_smtp_t)
+')
+
+optional_policy(`
 	dovecot_stream_connect_auth(postfix_smtpd_t)
 	dovecot_stream_connect(postfix_smtpd_t)
 ')
Index: refpolicy-2.20180701/policy/modules/services/tor.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/services/tor.te
+++ refpolicy-2.20180701/policy/modules/services/tor.te
@@ -1,4 +1,4 @@
-policy_module(tor, 1.15.0)
+policy_module(tor, 1.15.2)
 
 ########################################
 #
@@ -99,6 +99,7 @@ corenet_tcp_sendrecv_all_ports(tor_t)
 corenet_tcp_sendrecv_all_reserved_ports(tor_t)
 
 dev_read_sysfs(tor_t)
+dev_read_rand(tor_t)
 dev_read_urand(tor_t)
 
 domain_use_interactive_fds(tor_t)
@@ -107,11 +108,14 @@ files_read_etc_runtime_files(tor_t)
 files_read_usr_files(tor_t)
 
 fs_search_tmpfs(tor_t)
+# for log symlink on a tmpfs filesystem systemd creates for it
+fs_read_tmpfs_symlinks(tor_t)
 
 auth_use_nsswitch(tor_t)
 
 logging_send_syslog_msg(tor_t)
 
+miscfiles_read_generic_certs(tor_t)
 miscfiles_read_localization(tor_t)
 
 tunable_policy(`tor_bind_all_unreserved_ports',`
Index: refpolicy-2.20180701/policy/modules/system/authlogin.if
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/system/authlogin.if
+++ refpolicy-2.20180701/policy/modules/system/authlogin.if
@@ -47,6 +47,7 @@ interface(`auth_use_pam',`
 	# for encrypted homedir
 	dev_read_sysfs($1)
 
+	auth_create_faillog_files($1)
 	auth_domtrans_chk_passwd($1)
 	auth_domtrans_upd_passwd($1)
 	auth_dontaudit_read_shadow($1)
@@ -54,6 +55,7 @@ interface(`auth_use_pam',`
 	auth_append_login_records($1)
 	auth_rw_lastlog($1)
 	auth_rw_faillog($1)
+	auth_setattr_faillog_files($1)
 	auth_exec_pam($1)
 	auth_use_nsswitch($1)
 
@@ -746,6 +748,24 @@ interface(`auth_append_faillog',`
 
 ########################################
 ## <summary>
+##	Create fail log lock (in /run/faillock).
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`auth_create_faillog_files',`
+	gen_require(`
+		type faillog_t;
+	')
+
+	create_files_pattern($1, faillog_t, faillog_t)
+')
+
+########################################
+## <summary>
 ##	Read and write the login failure log.
 ## </summary>
 ## <param name="domain">
@@ -782,6 +802,24 @@ interface(`auth_manage_faillog',`
 	logging_rw_generic_log_dirs($1)
 ')
 
+########################################
+## <summary>
+##	Setattr the login failure logs.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`auth_setattr_faillog_files',`
+	gen_require(`
+		type faillog_t;
+	')
+
+	setattr_files_pattern($1, faillog_t, faillog_t)
+')
+
 #######################################
 ## <summary>
 ##	Read the last logins log.
@@ -823,6 +861,25 @@ interface(`auth_append_lastlog',`
 
 #######################################
 ## <summary>
+##	relabel the last logins log.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`auth_relabel_lastlog',`
+	gen_require(`
+		type lastlog_t;
+	')
+
+	logging_search_logs($1)
+	allow $1 lastlog_t:file { relabelfrom relabelto };
+')
+
+#######################################
+## <summary>
 ##	Read and write to the last logins log.
 ## </summary>
 ## <param name="domain">
@@ -841,6 +898,25 @@ interface(`auth_rw_lastlog',`
 ')
 
 ########################################
+## <summary>
+##     Manage the last logins log.
+## </summary>
+## <param name="domain">
+##     <summary>
+##     Domain allowed access.
+##     </summary>
+## </param>
+#
+interface(`auth_manage_lastlog',`
+	gen_require(`
+		type lastlog_t;
+	')
+
+	allow $1 lastlog_t:file manage_file_perms;
+	logging_rw_generic_log_dirs($1)
+')
+
+########################################
 ## <summary>
 ##	Execute pam programs in the pam domain.
 ## </summary>
Index: refpolicy-2.20180701/policy/modules/system/authlogin.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/system/authlogin.te
+++ refpolicy-2.20180701/policy/modules/system/authlogin.te
@@ -1,4 +1,4 @@
-policy_module(authlogin, 2.13.0)
+policy_module(authlogin, 2.13.2)
 
 ########################################
 #
Index: refpolicy-2.20180701/policy/modules/system/locallogin.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/system/locallogin.te
+++ refpolicy-2.20180701/policy/modules/system/locallogin.te
@@ -1,4 +1,4 @@
-policy_module(locallogin, 1.18.0)
+policy_module(locallogin, 1.18.1)
 
 ########################################
 #
@@ -34,7 +34,7 @@ role system_r types sulogin_t;
 
 allow local_login_t self:capability { chown dac_read_search dac_override fowner fsetid kill setgid setuid sys_nice sys_resource sys_tty_config };
 dontaudit local_login_t self:capability net_admin;
-allow local_login_t self:process { setexec setrlimit setsched };
+allow local_login_t self:process { getcap setcap setexec setrlimit setsched };
 allow local_login_t self:fd use;
 allow local_login_t self:fifo_file rw_fifo_file_perms;
 allow local_login_t self:sock_file read_sock_file_perms;
@@ -127,6 +127,7 @@ init_dontaudit_use_fds(local_login_t)
 
 miscfiles_read_localization(local_login_t)
 
+userdom_manage_all_users_keys(local_login_t)
 userdom_spec_domtrans_all_users(local_login_t)
 userdom_signal_all_users(local_login_t)
 userdom_search_user_home_content(local_login_t)
Index: refpolicy-2.20180701/policy/modules/system/lvm.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/system/lvm.te
+++ refpolicy-2.20180701/policy/modules/system/lvm.te
@@ -1,4 +1,4 @@
-policy_module(lvm, 1.21.0)
+policy_module(lvm, 1.21.1)
 
 ########################################
 #
@@ -214,6 +214,8 @@ read_files_pattern(lvm_t, lvm_etc_t, lvm
 allow lvm_t lvm_etc_t:file map;
 
 read_lnk_files_pattern(lvm_t, lvm_etc_t, lvm_etc_t)
+# Map for vgchange on /etc/lvm/backup/ files
+allow lvm_t lvm_metadata_t:file map;
 # Write to /etc/lvm, /etc/lvmtab, /etc/lvmtab.d
 manage_files_pattern(lvm_t, lvm_metadata_t, lvm_metadata_t)
 filetrans_pattern(lvm_t, lvm_etc_t, lvm_metadata_t, file)
Index: refpolicy-2.20180701/policy/modules/system/raid.if
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/system/raid.if
+++ refpolicy-2.20180701/policy/modules/system/raid.if
@@ -48,6 +48,26 @@ interface(`raid_run_mdadm',`
 
 ########################################
 ## <summary>
+##	read mdadm pid files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`raid_read_mdadm_pid',`
+	gen_require(`
+		type mdadm_var_run_t;
+	')
+
+	files_search_pids($1)
+	allow $1 mdadm_var_run_t:dir list_dir_perms;
+	allow $1 mdadm_var_run_t:file read_file_perms;
+')
+
+########################################
+## <summary>
 ##	Create, read, write, and delete
 ##	mdadm pid files.
 ## </summary>
Index: refpolicy-2.20180701/policy/modules/system/raid.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/system/raid.te
+++ refpolicy-2.20180701/policy/modules/system/raid.te
@@ -1,4 +1,4 @@
-policy_module(raid, 1.18.0)
+policy_module(raid, 1.18.1)
 
 ########################################
 #
Index: refpolicy-2.20180701/policy/modules/admin/apt.if
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/admin/apt.if
+++ refpolicy-2.20180701/policy/modules/admin/apt.if
@@ -171,7 +171,7 @@ interface(`apt_read_cache',`
 
 	files_search_var($1)
 	allow $1 apt_var_cache_t:dir list_dir_perms;
-	allow $1 apt_var_cache_t:file read_file_perms;
+	allow $1 apt_var_cache_t:file mmap_read_file_perms;
 ')
 
 ########################################
@@ -191,7 +191,7 @@ interface(`apt_manage_cache',`
 
 	files_search_var($1)
 	allow $1 apt_var_cache_t:dir manage_dir_perms;
-	allow $1 apt_var_cache_t:file manage_file_perms;
+	allow $1 apt_var_cache_t:file { manage_file_perms map };
 ')
 
 ########################################
Index: refpolicy-2.20180701/policy/modules/roles/sysadm.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/roles/sysadm.te
+++ refpolicy-2.20180701/policy/modules/roles/sysadm.te
@@ -1,4 +1,4 @@
-policy_module(sysadm, 2.13.0)
+policy_module(sysadm, 2.13.1)
 
 ########################################
 #
@@ -711,6 +711,10 @@ optional_policy(`
 ')
 
 optional_policy(`
+        nsd_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
 	nslcd_admin(sysadm_t, sysadm_r)
 ')
 
Index: refpolicy-2.20180701/policy/modules/services/cron.fc
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/services/cron.fc
+++ refpolicy-2.20180701/policy/modules/services/cron.fc
@@ -26,6 +26,7 @@
 /var/lib/glpi/files(/.*)?	gen_context(system_u:object_r:cron_var_lib_t,s0)
 
 /var/log/cron.*	gen_context(system_u:object_r:cron_log_t,s0)
+/var/log/popularity-contest.*	gen_context(system_u:object_r:cron_log_t,s0)
 /var/log/rpmpkgs.*	--	gen_context(system_u:object_r:cron_log_t,s0)
 
 /run/anacron\.pid	--	gen_context(system_u:object_r:crond_var_run_t,s0)
Index: refpolicy-2.20180701/policy/modules/services/nsd.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/services/nsd.te
+++ refpolicy-2.20180701/policy/modules/services/nsd.te
@@ -1,4 +1,4 @@
-policy_module(nsd, 1.11.0)
+policy_module(nsd, 1.11.1)
 
 ########################################
 #
@@ -34,7 +34,7 @@ files_type(nsd_zone_t)
 # Local policy
 #
 
-allow nsd_t self:capability { chown dac_override kill setgid setuid };
+allow nsd_t self:capability { chown dac_override kill setgid setuid dac_read_search net_admin };
 dontaudit nsd_t self:capability sys_tty_config;
 allow nsd_t self:process signal_perms;
 allow nsd_t self:fifo_file rw_fifo_file_perms;
@@ -44,12 +44,13 @@ allow nsd_t nsd_conf_t:dir list_dir_perm
 allow nsd_t nsd_conf_t:file read_file_perms;
 allow nsd_t nsd_conf_t:lnk_file read_lnk_file_perms;
 
-allow nsd_t nsd_db_t:file manage_file_perms;
+allow nsd_t nsd_db_t:file { manage_file_perms map };
 filetrans_pattern(nsd_t, nsd_zone_t, nsd_db_t, file)
 
 manage_files_pattern(nsd_t, nsd_var_run_t, nsd_var_run_t)
 files_pid_filetrans(nsd_t, nsd_var_run_t, file)
 
+allow nsd_t nsd_zone_t:file map;
 manage_dirs_pattern(nsd_t, nsd_zone_t, nsd_zone_t)
 manage_files_pattern(nsd_t, nsd_zone_t, nsd_zone_t)
 manage_lnk_files_pattern(nsd_t, nsd_zone_t, nsd_zone_t)
Index: refpolicy-2.20180701/policy/modules/services/ntp.fc
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/services/ntp.fc
+++ refpolicy-2.20180701/policy/modules/services/ntp.fc
@@ -13,6 +13,7 @@
 /etc/rc\.d/init\.d/ntpd? 		--	gen_context(system_u:object_r:ntpd_initrc_exec_t,s0)
 
 /run/ntpd\.pid				--	gen_context(system_u:object_r:ntpd_pid_t,s0)
+/run/systemd/timesync(/.*)?			gen_context(system_u:object_r:ntpd_pid_t,s0)
 
 /usr/bin/ntpd				--	gen_context(system_u:object_r:ntpd_exec_t,s0)
 /usr/bin/ntpdate			--	gen_context(system_u:object_r:ntpdate_exec_t,s0)
@@ -31,6 +32,7 @@
 /var/lib/ntp(/.*)?				gen_context(system_u:object_r:ntp_drift_t,s0)
 /var/lib/sntp-kod(/.*)?				gen_context(system_u:object_r:ntp_drift_t,s0)
 /var/lib/systemd/clock			--	gen_context(system_u:object_r:ntp_drift_t,s0)
+/var/lib/systemd/timesync(/.*)?			gen_context(system_u:object_r:ntp_drift_t,s0)
 
 /var/lock/ntpdate                       --      gen_context(system_u:object_r:ntpd_lock_t,s0)
 
Index: refpolicy-2.20180701/policy/modules/services/openvpn.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/services/openvpn.te
+++ refpolicy-2.20180701/policy/modules/services/openvpn.te
@@ -1,4 +1,4 @@
-policy_module(openvpn, 1.16.0)
+policy_module(openvpn, 1.16.1)
 
 ########################################
 #
@@ -175,3 +175,7 @@ optional_policy(`
 		networkmanager_dbus_chat(openvpn_t)
 	')
 ')
+
+optional_policy(`
+	systemd_use_passwd_agent(openvpn_t)
+')
Index: refpolicy-2.20180701/policy/modules/services/ssh.if
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/services/ssh.if
+++ refpolicy-2.20180701/policy/modules/services/ssh.if
@@ -181,7 +181,7 @@ template(`ssh_server_template', `
 	type $1_var_run_t;
 	files_pid_file($1_var_run_t)
 
-	allow $1_t self:capability { chown dac_override fowner fsetid kill setgid setuid sys_chroot sys_nice sys_resource sys_tty_config };
+	allow $1_t self:capability { chown dac_read_search fowner fsetid kill setgid setuid sys_chroot sys_nice sys_resource sys_tty_config };
 	# net_admin is for SO_SNDBUFFORCE
 	dontaudit $1_t self:capability net_admin;
 	allow $1_t self:fifo_file rw_fifo_file_perms;
Index: refpolicy-2.20180701/policy/modules/system/systemd.fc
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/system/systemd.fc
+++ refpolicy-2.20180701/policy/modules/system/systemd.fc
@@ -28,6 +28,7 @@
 /usr/lib/systemd/systemd-machined	--	gen_context(system_u:object_r:systemd_machined_exec_t,s0)
 /usr/lib/systemd/systemd-networkd	--	gen_context(system_u:object_r:systemd_networkd_exec_t,s0)
 /usr/lib/systemd/systemd-resolved	--	gen_context(system_u:object_r:systemd_resolved_exec_t,s0)
+/usr/lib/systemd/systemd-rfkill		--	gen_context(system_u:object_r:systemd_rfkill_exec_t,s0)
 /usr/lib/systemd/systemd-update-done	--	gen_context(system_u:object_r:systemd_update_done_exec_t,s0)
 /usr/lib/systemd/systemd-user-sessions	--	gen_context(system_u:object_r:systemd_sessions_exec_t,s0)
 
@@ -42,14 +43,18 @@
 /usr/lib/systemd/system/systemd-backlight.*	--	gen_context(system_u:object_r:systemd_backlight_unit_t,s0)
 /usr/lib/systemd/system/systemd-binfmt.*	--	gen_context(system_u:object_r:systemd_binfmt_unit_t,s0)
 /usr/lib/systemd/system/systemd-networkd.*		gen_context(system_u:object_r:systemd_networkd_unit_t,s0)
+/usr/lib/systemd/system/systemd-rfkill.*	--	gen_context(system_u:object_r:systemd_rfkill_unit_t,s0)
 
 /var/lib/systemd/backlight(/.*)?	gen_context(system_u:object_r:systemd_backlight_var_lib_t,s0)
 /var/lib/systemd/coredump(/.*)?	gen_context(system_u:object_r:systemd_coredump_var_lib_t,s0)
 /var/lib/systemd/linger(/.*)?	gen_context(system_u:object_r:systemd_logind_var_lib_t,s0)
+/var/lib/systemd/rfkill(/.*)?	gen_context(system_u:object_r:systemd_rfkill_var_lib_t,s0)
 
 /run/\.nologin[^/]*	--	gen_context(system_u:object_r:systemd_sessions_var_run_t,s0)
 /run/nologin	--	gen_context(system_u:object_r:systemd_sessions_var_run_t,s0)
 
+/run/systemd/ask-password(/.*)?	gen_context(system_u:object_r:systemd_passwd_var_run_t,s0)
+/run/systemd/ask-password-block(/.*)?	gen_context(system_u:object_r:systemd_passwd_var_run_t,s0)
 /run/systemd/resolve(/.*)?  gen_context(system_u:object_r:systemd_resolved_var_run_t,s0)
 /run/systemd/seats(/.*)?	gen_context(system_u:object_r:systemd_sessions_var_run_t,s0)
 /run/systemd/sessions(/.*)?	gen_context(system_u:object_r:systemd_sessions_var_run_t,s0)
Index: refpolicy-2.20180701/policy/modules/kernel/kernel.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/kernel/kernel.te
+++ refpolicy-2.20180701/policy/modules/kernel/kernel.te
@@ -1,4 +1,4 @@
-policy_module(kernel, 1.24.0)
+policy_module(kernel, 1.24.1)
 
 ########################################
 #
@@ -47,7 +47,6 @@ ifdef(`enable_mls',`
 #
 type kernel_t, can_load_kernmodule;
 domain_base_type(kernel_t)
-mls_rangetrans_source(kernel_t)
 role system_r types kernel_t;
 sid kernel gen_context(system_u:system_r:kernel_t,mls_systemhigh)
 
@@ -295,6 +294,9 @@ fs_manage_tmpfs_files(kernel_t)
 fs_manage_tmpfs_sockets(kernel_t)
 fs_delete_tmpfs_symlinks(kernel_t)
 
+mls_rangetrans_source(kernel_t)
+mls_process_set_level(kernel_t)
+
 selinux_getattr_fs(kernel_t)
 selinux_load_policy(kernel_t)
 
Index: refpolicy-2.20180701/policy/modules/system/iptables.if
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/system/iptables.if
+++ refpolicy-2.20180701/policy/modules/system/iptables.if
@@ -185,6 +185,44 @@ interface(`iptables_dontaudit_read_pids'
 
 ########################################
 ## <summary>
+##	Allow specified domain to start and stop iptables service
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`iptables_startstop',`
+	gen_require(`
+		type iptables_unit_t;
+		class service { start stop };
+	')
+
+	allow $1 iptables_unit_t:service { start stop };
+')
+
+########################################
+## <summary>
+##	Allow specified domain to get status of iptables service
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`iptables_status',`
+	gen_require(`
+		type iptables_unit_t;
+		class service status;
+	')
+
+	allow $1 iptables_unit_t:service status;
+')
+
+########################################
+## <summary>
 ##	All of the rules required to
 ##	administrate an iptables
 ##	environment.
Index: refpolicy-2.20180701/policy/modules/system/logging.if
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/system/logging.if
+++ refpolicy-2.20180701/policy/modules/system/logging.if
@@ -422,6 +422,9 @@ interface(`logging_domtrans_syslog',`
 
 	corecmd_search_bin($1)
 	domtrans_pattern($1, syslogd_exec_t, syslogd_t)
+	ifdef(`enable_mls',`
+		range_transition $1 syslogd_exec_t:process mls_systemhigh;
+	')
 ')
 
 ########################################
Index: refpolicy-2.20180701/policy/modules/apps/userhelper.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/apps/userhelper.te
+++ refpolicy-2.20180701/policy/modules/apps/userhelper.te
@@ -1,4 +1,4 @@
-policy_module(userhelper, 1.11.0)
+policy_module(userhelper, 1.11.1)
 
 ########################################
 #
@@ -149,7 +149,7 @@ auth_search_pam_console_data(userhelper_
 
 init_use_fds(userhelper_type)
 init_manage_utmp(userhelper_type)
-init_pid_filetrans_utmp(userhelper_type)
+init_runtime_filetrans_utmp(userhelper_type)
 
 logging_send_syslog_msg(userhelper_type)
 
Index: refpolicy-2.20180701/policy/modules/services/cgmanager.fc
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/services/cgmanager.fc
+++ refpolicy-2.20180701/policy/modules/services/cgmanager.fc
@@ -4,6 +4,9 @@
 /run/cgmanager.pid					gen_context(system_u:object_r:cgmanager_run_t,s0)
 /run/cgmanager/fs(/.*)?					<<none>>
 
+/usr/bin/cgmanager				--	gen_context(system_u:object_r:cgmanager_exec_t,s0)
+/usr/bin/cgproxy				--	gen_context(system_u:object_r:cgmanager_exec_t,s0)
+
 /usr/libexec/cgmanager/cgm-release-agent	--	gen_context(system_u:object_r:cgmanager_exec_t,s0)
 
 /usr/sbin/cgmanager				--	gen_context(system_u:object_r:cgmanager_exec_t,s0)
Index: refpolicy-2.20180701/policy/modules/services/cgmanager.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/services/cgmanager.te
+++ refpolicy-2.20180701/policy/modules/services/cgmanager.te
@@ -1,4 +1,4 @@
-policy_module(cgmanager, 1.1.0)
+policy_module(cgmanager, 1.1.1)
 
 ########################################
 #
Index: refpolicy-2.20180701/policy/modules/services/dhcp.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/services/dhcp.te
+++ refpolicy-2.20180701/policy/modules/services/dhcp.te
@@ -1,4 +1,4 @@
-policy_module(dhcp, 1.16.0)
+policy_module(dhcp, 1.16.1)
 
 ########################################
 #
@@ -105,6 +105,7 @@ auth_use_nsswitch(dhcpd_t)
 
 logging_send_syslog_msg(dhcpd_t)
 
+miscfiles_read_generic_certs(dhcpd_t)
 miscfiles_read_localization(dhcpd_t)
 
 sysnet_read_dhcp_config(dhcpd_t)
Index: refpolicy-2.20180701/policy/modules/services/gssproxy.fc
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/services/gssproxy.fc
+++ refpolicy-2.20180701/policy/modules/services/gssproxy.fc
@@ -1,3 +1,5 @@
+/usr/bin/gssproxy				--	gen_context(system_u:object_r:gssproxy_exec_t,s0)
+
 /usr/lib/systemd/system/gssproxy.service	--	gen_context(system_u:object_r:gssproxy_unit_t,s0)
 
 /usr/sbin/gssproxy				--	gen_context(system_u:object_r:gssproxy_exec_t,s0)
Index: refpolicy-2.20180701/policy/modules/services/gssproxy.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/services/gssproxy.te
+++ refpolicy-2.20180701/policy/modules/services/gssproxy.te
@@ -1,4 +1,4 @@
-policy_module(gssproxy, 1.1.0)
+policy_module(gssproxy, 1.1.1)
 
 ########################################
 #
Index: refpolicy-2.20180701/policy/modules/system/unconfined.if
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/system/unconfined.if
+++ refpolicy-2.20180701/policy/modules/system/unconfined.if
@@ -118,6 +118,11 @@ interface(`unconfined_domain_noaudit',`
 ##	<p>
 ##	Only completely trusted domains should use this interface.
 ##	</p>
+##	<p>
+##	Does not allow return communications from confined
+##	domains via message based mechanisms such as dbus or
+##	SysV message queues.
+##	</p>
 ## </desc>
 ## <param name="domain">
 ##	<summary>
Index: refpolicy-2.20180701/policy/modules/system/logging.fc
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/system/logging.fc
+++ refpolicy-2.20180701/policy/modules/system/logging.fc
@@ -1,11 +1,13 @@
 /dev/log		-s	gen_context(system_u:object_r:devlog_t,mls_systemhigh)
 
-/etc/rsyslog.conf		gen_context(system_u:object_r:syslog_conf_t,s0)
-/etc/syslog.conf		gen_context(system_u:object_r:syslog_conf_t,s0)
-/etc/rsyslog.d(/.*)?	gen_context(system_u:object_r:syslog_conf_t,s0)
-/etc/audit(/.*)?		gen_context(system_u:object_r:auditd_etc_t,mls_systemhigh)
-/etc/rc\.d/init\.d/auditd --	gen_context(system_u:object_r:auditd_initrc_exec_t,s0)
-/etc/rc\.d/init\.d/rsyslog --	gen_context(system_u:object_r:syslogd_initrc_exec_t,s0)
+/etc/rsyslog\.conf					--	gen_context(system_u:object_r:syslog_conf_t,s0)
+/etc/syslog\.conf					--	gen_context(system_u:object_r:syslog_conf_t,s0)
+/etc/rsyslog\.d(/.*)?					gen_context(system_u:object_r:syslog_conf_t,s0)
+/etc/audit(/.*)?						gen_context(system_u:object_r:auditd_etc_t,mls_systemhigh)
+/etc/systemd/journal.*\.conf		--	gen_context(system_u:object_r:syslog_conf_t,s0)
+/etc/systemd/journald\.conf\.d(/.*)?	gen_context(system_u:object_r:syslog_conf_t,s0)
+/etc/rc\.d/init\.d/auditd 			--	gen_context(system_u:object_r:auditd_initrc_exec_t,s0)
+/etc/rc\.d/init\.d/rsyslog 			--	gen_context(system_u:object_r:syslogd_initrc_exec_t,s0)
 
 /usr/bin/audispd	--	gen_context(system_u:object_r:audisp_exec_t,s0)
 /usr/bin/audisp-remote	--	gen_context(system_u:object_r:audisp_remote_exec_t,s0)
Index: refpolicy-2.20180701/policy/modules/system/sysnetwork.fc
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/system/sysnetwork.fc
+++ refpolicy-2.20180701/policy/modules/system/sysnetwork.fc
@@ -18,6 +18,7 @@ ifdef(`distro_debian',`
 /etc/hosts		--	gen_context(system_u:object_r:net_conf_t,s0)
 /etc/hosts\.allow.*	--	gen_context(system_u:object_r:net_conf_t,s0)
 /etc/hosts\.deny.*	--	gen_context(system_u:object_r:net_conf_t,s0)
+/etc/hostname		--	gen_context(system_u:object_r:net_conf_t,s0)
 /etc/denyhosts.*	--	gen_context(system_u:object_r:net_conf_t,s0)
 /etc/resolv\.conf.*	--	gen_context(system_u:object_r:net_conf_t,s0)
 /etc/yp\.conf.*		--	gen_context(system_u:object_r:net_conf_t,s0)
Index: refpolicy-2.20180701/policy/modules/admin/dmidecode.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/admin/dmidecode.te
+++ refpolicy-2.20180701/policy/modules/admin/dmidecode.te
@@ -1,4 +1,4 @@
-policy_module(dmidecode, 1.8.0)
+policy_module(dmidecode, 1.8.1)
 
 ########################################
 #
@@ -32,3 +32,9 @@ mls_file_read_all_levels(dmidecode_t)
 locallogin_use_fds(dmidecode_t)
 
 userdom_use_inherited_user_terminals(dmidecode_t)
+
+ifdef(`init_systemd',`
+	# inherits /dev/null and a socket from devicekit_disk_t
+	init_use_fds(dmidecode_t)
+	init_rw_inherited_stream_socket(dmidecode_t)
+')
